Configure Detection Thresholds

Tasks

Adjust the call-rate, token-spike, and repeated-prompt thresholds that drive anomaly detection, and route the resulting alerts to the channels your team monitors.

Set detection thresholds

1. Navigate to Settings → Anomaly Detection.

2. Set the three thresholds:

   Threshold	Default	What triggers it
   Max calls per minute	60	A session exceeds this call rate in any rolling 1-minute window. Counts all MCP tool calls and LLM requests combined.
   Token spike threshold	50 000	A single LLM request uses more tokens than this value. Catches unexpectedly large context payloads — for example, a read_file on a multi-megabyte binary piped into a prompt.
   Max repeated prompts	5	The same prompt hash appears more than N times in the last 20 calls. Detects prompt-loop behavior, runaway retry logic, or agents stuck in a repeat cycle.

3. Save. All three thresholds are independent — any one can fire an anomaly event without the others being crossed.

note

Run detection in observation mode (auto-pause off) and watch the Session Anomalies feed for at least a week before enabling enforcement — see Enable auto-pause below.

Tune thresholds for agentic workloads

Default thresholds are calibrated for interactive developer use and are usually too tight for automated or multi-agent workloads.

1. Open the Session Anomalies feed under Security → Detections and observe the real metric values your team's agentic workloads produce (each anomaly entry shows the exact triggering value).

2. Adjust thresholds in Settings → Anomaly Detection based on the workload pattern:

   Workload pattern	Recommended adjustment
   Claude Code with sub-agents (fan-out)	Raise Max calls per minute to 150–200
   Large file indexing or repo scanning	Raise Token spike threshold to 150 000–200 000
   Iterative code generation loops	Raise Max repeated prompts to 10–15

3. Save, then continue watching the feed to confirm the new ceilings stop flagging normal activity without hiding genuine anomalies.

Enable auto-pause

By default, anomalies create alerts but never block developers.

1. Navigate to Settings → Anomaly Detection.

2. Turn on Auto-pause on anomaly (default: Off). When off, anomalies only produce alerts; when on, sessions can be paused once the cumulative count is reached.

3. Set Pause after N anomalies (default: 20) — the number of cumulative anomaly events in a session before it is paused. This guards against pausing on a single transient spike.

4. Save. When a session is paused, the developer's next request returns a session_paused error with instructions to contact their admin. Admins can resume the session from Identity → Sessions or from the alert detail in Security → Detections.

warning

Enable auto-pause only after observing anomaly patterns in the feed for at least a week. Premature enablement with default thresholds can pause legitimate agentic workloads during normal operation.

Configure alert delivery channels

1. Navigate to Settings → Notifications.

2. Choose delivery channels: Slack, email, Microsoft Teams, and in-app (the bell icon).

3. Configure routing per event type — for example, route anomaly alerts to Slack while sending budget alerts only via email.

4. Save. Channel delivery is best-effort — the Baseline Alerts tab in Security → Detections always shows the complete alert history regardless of delivery configuration.

See also

• Detections