Scheduled and on-demand anomaly checks for AI agent authorization. The implemented detector evaluates high action volume, high failure rates, new agent-principal pairs, and off-hours activity, then stores findings for review.
Agents run 24/7, make thousands of API calls, and delegate to sub-agents. Without real-time monitoring, compromised or misbehaving agents go unnoticed.
The worker runs on startup and then hourly by default. The protected detection endpoint can also run the same checks on demand.
Four SQL-backed checks currently evaluate action volume, failure rate, new agent-principal pairs, and off-hours activity.
Create and manage custom condition objects through the API. An evaluator for those custom definitions is not currently wired into detection.
Store Slack, generic webhook, or email channel configuration and severity filters. Automatic finding delivery requires a separate worker.
Finding APIs support open, acknowledged, and resolved status with timestamps and optional resolution notes.
Use the alert action to request grant revocation. Enforcement changes only after protected services receive current grant state; local JWT validation alone is not immediate revocation.
The server currently evaluates four SQL-backed checks: high action volume, high failure rate, new agent-principal pairs, and off-hours activity. The ten rows below are stored or illustrative rule definitions; the remaining definitions are not active detectors today.
Finding APIs record lifecycle status, timestamps, and optional resolution notes. Notification delivery and responder identity require the host application or a separate worker.
The API stores Slack, generic webhook, and email settings with severity filters. It does not yet dispatch anomaly findings to these destinations automatically.
Custom definitions can be created, listed, enabled, disabled, and deleted. They are configuration records today; the detector does not evaluate them automatically.
import { Grantex } from '@grantex/sdk'; const grantex = new Grantex({ apiKey: process.env.GRANTEX_API_KEY!, }); // Run the four implemented SQL-backed checks now const run = await grantex.anomalies.detect(); console.log(run.total, run.anomalies); // Review unacknowledged findings const open = await grantex.anomalies.list({ unacknowledged: true, }); if (open.anomalies[0]) { await grantex.anomalies.acknowledge(open.anomalies[0].id); }
Query finding counts via the protected API, manage lifecycle status,
or scrape implemented Prometheus metrics from /metrics.
GET /v1/anomaly/metrics returns counts by status and severity
for a 1h, 6h, or 24h window, with an optional agent filter.
List findings, acknowledge them, resolve them with a note, and query current lifecycle totals. The detector does not currently publish anomaly SSE events.
GET /metrics exposes grantex_anomalies_detected_total
and grantex_anomalies_unacknowledged alongside service metrics.
Run the four implemented checks on demand or use the hourly worker, then review and manage findings through the API or dashboard.