anomaly-alert

1# Anomaly Alert
2 
3Detect anomalous sessions in Claude Code Agent Monitor data.
4 
5## Input
6 
7The user provides: **$ARGUMENTS**
8 
9This may be:
10- "all" or empty (default: check all anomaly types)
11- "cost" for cost anomalies only
12- "duration" for duration anomalies only
13- "errors" for error rate anomalies only
14- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)
15 
16## Procedure
17 
181. **Fetch baseline data** from `http://localhost:4820`:
19   - `GET /api/sessions?limit=500` — historical sessions for baseline
20   - `GET /api/analytics` — aggregated metrics
21   - `GET /api/pricing/cost` — cost data per session
22 
232. **Compute baselines** for each metric:
24   - Mean, median, standard deviation
25   - P25, P75, P90, P95, P99 percentiles
26   - Interquartile range (IQR) for robust outlier detection
27 
283. **Detect anomalies** using statistical thresholds:
29 
30   ### Cost Anomalies
31   - Sessions costing >2σ above mean
32   - Single sessions exceeding daily average
33   - Sudden cost spikes (session-over-session increase >200%)
34 
35   ### Duration Anomalies
36   - Sessions lasting >2σ above mean duration
37   - Extremely short sessions (<1 minute) that still incur cost
38   - Sessions with unusual active-vs-idle ratios
39 
40   ### Error Rate Anomalies
41   - Sessions with error rates >2σ above baseline
42   - New error types not seen in previous sessions
43   - Sessions with >3 consecutive tool failures
44 
45   ### Behavioral Anomalies
46   - Unusual tool combinations not seen before
47…