Claude Code Agent Monitor is a dashboard that records and displays activity from Claude Code and Codex coding-agent sessions, including tool use and subagent coordination. It is for people who need live visibility into agent work through a web interface or native desktop app. The catalogue entries extend Claude Code with skills, commands, agents, plugins, instructions, hooks, and settings related to the monitor.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alertgit clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-MonitorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hoangsonww/claude-code-agent-monitor/anomaly-alert)<a href="https://agentmods.dev/skills/hoangsonww/claude-code-agent-monitor/anomaly-alert"><img src="https://agentmods.dev/badge/skills/hoangsonww/claude-code-agent-monitor/anomaly-alert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hoangsonww/claude-code-agent-monitor/anomaly-alert"><img src="https://agentmods.dev/badge/skills/hoangsonww/claude-code-agent-monitor/anomaly-alert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.00728 |
| Opus 5.5 | $0.00034 | $0.00291 |
| Sonnet 5.5 | $0.00017 | $0.00146 |
| Haiku 4.5 | $0.00009 | $0.00073 |
Grade A, and why
anomaly-alert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Anomaly Alert
Detect anomalous sessions in Claude Code Agent Monitor data.
Input
The user provides: $ARGUMENTS
This may be:
- "all" or empty (default: check all anomaly types)
- "cost" for cost anomalies only
- "duration" for duration anomalies only
- "errors" for error rate anomalies only
- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)
Procedure
-
Fetch baseline data from
http://localhost:4820:GET /api/sessions?limit=500— historical sessions for baselineGET /api/analytics— aggregated metricsGET /api/pricing/cost— cost data per session
-
Compute baselines for each metric:
- Mean, median, standard deviation
- P25, P75, P90, P95, P99 percentiles
- Interquartile range (IQR) for robust outlier detection
-
Detect anomalies using statistical thresholds:
Cost Anomalies
- Sessions costing >2σ above mean
- Single sessions exceeding daily average
- Sudden cost spikes (session-over-session increase >200%)
Duration Anomalies
- Sessions lasting >2σ above mean duration
- Extremely short sessions (<1 minute) that still incur cost
- Sessions with unusual active-vs-idle ratios
Error Rate Anomalies
- Sessions with error rates >2σ above baseline
- New error types not seen in previous sessions
- Sessions with >3 consecutive tool failures
Behavioral Anomalies
- Unusual tool combinations not seen before
- Sessions with abnormally high compaction counts
- Model switches mid-session (if unexpected)
- Sessions with no tool usage (pure conversation)
Token Anomalies
- Input/output token ratio far from historical norm
- Cache miss rate significantly higher than average
- Token usage growing faster than session count
-
Classify each anomaly:
- 🔴 Critical: Likely indicates a real problem requiring attention
- 🟡 Warning: Unusual but may be expected for certain tasks
- 🔵 Info: Interesting deviation worth noting
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 90 lines · 86 tokens per session scan A 7ae5f37440aa
anomaly-alert is a skill published in the GitHub repository hoangsonww/Claude-Code-Agent-Monitor (1,124 stars, last pushed 4d ago), licensed MIT. It adds 86 tokens to every session and 728 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
code-remediate
Collect and resolve selected findings in one pass, then verify; bare PR targets use online items, while PR +review authorizes matching review evidence and any needed review step.
challenge-resolve
Independently review and fix a bounded task through convergence rounds, with evidence-backed closure and explicit stop/remediation decisions. Use only when the user explicitly requests an adversarial review-and-fix loop over an existing implementation, feature, problem, or diff; not for ordinary review (code-review)…
php-quality-tooling
Use when setting up PHPStan, Rector, or PHP-CS-Fixer on a non-Laravel PHP project, incl. CI wiring. Do NOT use for Laravel (Pint/Larastan), tests, or syntax.
Rig Optimize
Improve a measured performance metric in guarded rounds, keeping only changes that beat the baseline noise and pass every correctness gate.
Rig Investigate
Reproduce a failure and narrow it to an evidence-backed root cause before fixing.
Rig Doctor
Check opencode-rig install health and report exact remediation steps.