Single-Series Anomaly Detection

data_drift answers “did the distribution shift between two batches” — it cannot point at which value in one live series is anomalous — and slo.burn_alerts only thresholds error-budget burn, not arbitrary metric values (latency spikes, cost spikes, CPU). This flags outliers in a single series via z-score, robust MAD (modified z-score), and an EWMA control chart.

Pure standard library (math / statistics); imports no PySide6. Every function is pure (values in, flags out), so it is fully deterministic in CI.

Headless API

from je_auto_control import detect_anomalies, mad_anomalies, ewma_control

series = [10, 11, 9, 10, 12, 10, 95, 11, 10]    # index 6 is the spike
mad_anomalies(series)                            # [6]  (robust)
detect_anomalies(series, method="mad")
# [{index, value, score, is_anomaly}, ...]

ewma_control(values, alpha=0.5, target_mean=10, target_sigma=1)  # shift indices

detect_anomalies scores each value (mad default, or zscore) and flags those past the threshold (3.5 for MAD, 3.0 for z-score). mad_anomalies / zscore_anomalies return just the flagged indices, and mad_scores / zscore_scores the raw scores. MAD (Iglewicz-Hoaglin modified z-score) is robust to outliers inflating the spread, so it stays sensitive where a plain z-score would not. ewma_control is an EWMA control chart for sustained level shifts — pass target_mean / target_sigma for an in-control baseline (else the series’ own stats).

Executor command

AC_detect_anomalies takes a values list (optional method / threshold) and returns {results}. It is exposed as the MCP tool ac_detect_anomalies and as a Script Builder command under Data.