Time-series anomaly detection and alerting with a dbt-like project layout. A metric is a SQL query plus a detector in YAML — run it with one command.
One command sets up Claude Code for your
project folder — a CLAUDE.md, a .claude/rules/detectkit/ reference,
and four skills: dtk-setup-project (configure your database),
dtk-new-metric (scaffold a metric), dtk-autotune (auto-tune a
detector against labeled incidents), and dtk-feedback (file a redacted bug
report or feature request upstream). Now an assistant writes metrics, tunes detectors,
wires up alerts, and reports issues with full knowledge of detectkit. Re-run it after an
upgrade to refresh the context.
A metric is just a query plus a detector in YAML. dtk run handles the
corridor, the quorum and the alert — nothing else to wire up.
The real output of dtk run — a load → detect → alert tree with cyan step
headers and colored status lines. Idempotent: it resumes from the last saved point.
Run the SQL on your warehouse, in batches, from the last checkpoint.
Each detector scores points against its learned corridor of normal.
Quorum met → post to chat with the rule up top, recovery on the way back.
Every detector learns a corridor of normal from recent history, then flags the moment a metric steps outside it. Switch the detector to see the kind of metric it's built for.
Measures the typical distance from the median. A handful of wild spikes barely move it — the most robust default.
Classic mean ± k standard deviations. Fast and simple, but one big outlier inflates the band — keep it for clean data.
Builds the corridor from the middle 50% of values, then extends fences 1.5×IQR out. Comfortable with skewed, long-tailed data.
No statistics at all — you set hard floor and ceiling values. Alerts the instant a metric crosses a known SLA line.
// the corridor is recomputed per window with seasonality grouping & recency weighting —
newer points count more
// each detector is shown on the metric shape it handles best — robust, bell-shaped, skewed
or hard-bounded
An interactive sandbox running the actual detectkit detector in your browser. Dial in a series that looks like one of yours, turn the detector's real knobs, and watch the corridor of normal, what gets flagged, and whether an alert would fire — nothing is sent anywhere.
Autotune already tunes well with zero labels. To optimise against your
real incidents, run dtk autotune --select <metric> --label — it opens
a chart where you drag across each incident, add a note, and Export one
self-contained file: offline, nothing leaves your browser, every round versioned.
Direction-aware multi-detector quorum, cooldown, recovery and no-data alerts — posted to chat with the alert and its rule up top, anomaly evidence below.
The same alert, posted by detectkit to each channel — rendered as that channel formats it: a
fields attachment on Slack/Mattermost, escaped HTML on Telegram, a branded card in email.
Each leads with the project name ([payments]) so several projects can share one
channel while keeping the brand bot identity. The dashboard_url below becomes a
first-class link on every channel.
min_detectors=1 · direction=same · consecutive=3
• Value: 4.2 · Expected: <= 1.1
• Quorum: 1/1 · above
• Severity: 3.40
• Anomaly began: 2026-06-19 11:14:00 (Europe/Moscow) · Latest reading: 2026-06-19 12:04:00 (Europe/Moscow)
• Detector: mad
• Parameters: {"threshold": 3.0, "window_size": 2016, "half_life": "1d"}
Open dashboard · How to read this alert
@oncall_engineermin_detectors=1 · direction=same · consecutive=3
• Value: 1.0 · Expected: <= 1.1
• Anomaly began: 2026-06-19 11:36:00 (Europe/Moscow) · Alert fired: 2026-06-19 11:56:00 (Europe/Moscow) · Recovered: 2026-06-19 12:36:00 (Europe/Moscow)
• Detector: mad
Open dashboard · How to read this alert
@oncall_engineermin_detectors=1 · direction=same · consecutive=3min_detectors=1 · direction=same · consecutive=3alerting: channels: [mattermost_ops] dashboard_url: https://grafana.ops/d/api-errors # one line → a link on every channel
SQL + YAML, one command. No agents, no dashboards to babysit.