/anomaly-alert

name: anomaly-alert
description: >
  Identify anomalous sessions using Agent Monitor data — cost outliers from
  the pricing engine, token anomalies (cache miss spikes, compaction baseline
  surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError
  clusters), behavioral deviations from workflow intelligence (complexity
  score outliers, error propagation anomalies), and sessions with abnormal
  metadata (extreme turn_count, high thinking_blocks, zero turn_duration).

Anomaly Alert

Detect anomalous sessions in Claude Code Agent Monitor data.

Input

The user provides: **$ARGUMENTS**

This may be:

• "all" or empty (default: check all anomaly types)
• "cost" for cost anomalies only
• "duration" for duration anomalies only
• "errors" for error rate anomalies only
• A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)

Procedure

1. **Fetch baseline data** from `http://localhost:4820`:

• `GET /api/sessions?limit=500` — historical sessions for baseline
• `GET /api/analytics` — aggregated metrics
• `GET /api/pricing/cost` — cost data per session

2. **Compute baselines** for each metric:

• Mean, median, standard deviation
• P25, P75, P90, P95, P99 percentiles
• Interquartile range (IQR) for robust outlier detection

3. **Detect anomalies** using statistical thresholds:

Cost Anomalies

• Sessions costing >2σ above mean
• Single sessions exceeding daily average
• Sudden cost spikes (session-over-session increase >200%)

Duration Anomalies

• Sessions lasting >2σ above mean duration
• Extremely short sessions (<1 minute) that still incur cost
• Sessions with unusual active-vs-idle ratios

Error Rate Anomalies

• Sessions with error rates >2σ above baseline
• New error types not seen in previous sessions
• Sessions with >3 consecutive tool failures

Behavioral Anomalies

• Unusual tool combinations not seen before
• Sessions with abnormally high compaction counts
• Model switches mid-session (if unexpected)
• Sessions with no tool usage (pure conversation)

Token Anomalies

• Input/output token ratio far from historical norm
• Cache miss rate significantly higher than average
• Token usage growing faster than session count

4. **Classify each anomaly**:

• **🔴 Critical**: Likely indicates a real problem requiring attention
• **🟡 Warning**: Unusual but may be expected for certain tasks
• **🔵 Info**: Interesting deviation worth noting

Output Format

Present as an **Anomaly Report**:

═══════════════════════════════════════════════
  ANOMALY DETECTION REPORT
  Analyzed: N sessions | Baseline: last 30 days
  Anomalies found: N (🔴 N critical, 🟡 N warn, 🔵 N info)
═══════════════════════════════════════════════

For each anomaly:

• Session ID and timestamp
• Anomaly type and severity
• Observed value vs expected range
• Possible explanation
• Recommended action (if any)