Anomaly Alert

This pulls session data from your local Agent Monitor instance and flags statistical outliers across cost, duration, errors, tokens, and behavior patterns. It calculates baselines from your last 500 sessions, then surfaces things like sessions costing 2σ above mean, cache miss spikes, unusual tool combinations, or error rate jumps. You get a severity-coded report with observed versus expected ranges. Honestly most useful after you've accumulated enough session history for the statistics to mean something, otherwise you're just getting noise from a sparse baseline. The configurable sensitivity levels (strict/normal/relaxed) help once you know what normal looks like for your workflows.

GitHub stars: 455
last updated: Jun 11, 2026

View on GitHub

Install

$ npx -y skills add hoangsonww/claude-code-agent-monitor --skill anomaly-alert --agent claude-code

Installs into .claude/skills of the current project.

Files

Anomaly Alert

Detect anomalous sessions in Claude Code Agent Monitor data.

Input

The user provides: $ARGUMENTS

This may be:

"all" or empty (default: check all anomaly types)
"cost" for cost anomalies only
"duration" for duration anomalies only
"errors" for error rate anomalies only
A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)

Procedure

Fetch baseline data from http://localhost:4820:
- GET /api/sessions?limit=500 — historical sessions for baseline
- GET /api/analytics — aggregated metrics
- GET /api/pricing/cost — cost data per session
Compute baselines for each metric:
- Mean, median, standard deviation
- P25, P75, P90, P95, P99 percentiles
- Interquartile range (IQR) for robust outlier detection
Detect anomalies using statistical thresholds:

Cost Anomalies
- Sessions costing >2σ above mean
- Single sessions exceeding daily average
- Sudden cost spikes (session-over-session increase >200%)