Real-time anomaly detection for AI agent authorization. 10 built-in rules catch velocity spikes, scope escalation, token replay, and more. Alert to Slack, PagerDuty, or Datadog in seconds.
Agents run 24/7, make thousands of API calls, and delegate to sub-agents. Without real-time monitoring, compromised or misbehaving agents go unnoticed.
Anomalies are detected as events flow through Grantex. No batch processing delay. Alerts fire within 1 second of the triggering event.
10 built-in detection rules cover the most common agent misbehavior patterns. Each rule is battle-tested and tuned to minimize false positives.
Write your own rules with agent filters, scope filters, time windows, and thresholds. Deploy custom rules via the API or dashboard.
Route alerts to Slack, PagerDuty, Datadog, or email. Filter by severity so critical alerts page on-call while low-severity alerts log quietly.
Every alert has a clear lifecycle: open, acknowledged, resolved. Track who responded, when, and what action was taken. Full audit trail.
Revoke a misbehaving agent's grant directly from the alert. Cascading revocation stops all sub-agents immediately.
Every Grantex account ships with 10 anomaly detection rules that cover the most common agent security threats. Enable, disable, or tune them from the dashboard.
Every anomaly follows a clear lifecycle with full traceability. Know who responded, when, and what action was taken.
Route anomaly alerts to the tools your team uses. Filter by severity to keep noise low and signal high.
Built-in rules cover the common cases. Custom rules let you encode your organization's specific security policies.
import { Grantex } from '@grantex/sdk'; const grantex = new Grantex({ apiKey: process.env.GRANTEX_API_KEY }); // Create a custom rule that fires when any agent // makes more than 50 email:send requests in 5 minutes await grantex.anomalies.createRule({ ruleId: 'email_flood', name: 'Email Flood Detection', description: 'Too many email sends in a short window', severity: 'critical', condition: { scopes: ['email:send'], timeWindow: '5m', threshold: 50, }, channels: ['slack-incidents', 'pagerduty-oncall'], }); // Configure a Slack notification channel await grantex.anomalies.createChannel({ type: 'slack', name: 'slack-incidents', config: { webhookUrl: 'https://hooks.slack.com/services/...', }, severities: ['critical', 'high'], }); // Stream anomaly events in real time for await (const event of grantex.events.stream({ types: ['anomaly.detected'], })) { console.log('Alert:', event.data.ruleName, event.data.severity); }
Query anomaly metrics via the API, stream events over SSE, or scrape
Prometheus-format counters from the /metrics endpoint.
GET /v1/anomalies/metrics returns alert counts by severity,
by rule, and a 14-day activity histogram. Filter by agent or time window.
GET /v1/events/stream?types=anomaly.detected pushes
anomaly events in real time. Use with @grantex/destinations
to forward to Datadog, Splunk, or S3.
GET /metrics exposes grantex_anomalies_total,
grantex_alerts_open, and grantex_alerts_resolved
counters for Grafana dashboards.
Anomaly detection is available on all plans, including the free tier. 10 built-in rules. No configuration required.