@anyshift/mcp-proxy 0.3.6 → 0.4.0

package/dist/__tests__/unit/timeseries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/unit/timeseries.test.js

@@ -0,0 +1,217 @@
+import { describe, it, expect } from '@jest/globals';
+import { mean, median, standardDeviation, movingAverage, quantile, rollingQuantiles, } from '../../timeseries/algorithms/stats.js';
+import { detectMadAnomalies } from '../../timeseries/algorithms/mad.js';
+import { detectThresholdAnomalies } from '../../timeseries/algorithms/threshold.js';
+import { detectRollingQuantileAnomalies } from '../../timeseries/algorithms/rolling-quantile.js';
+import { detectMovingAverageAnomalies } from '../../timeseries/algorithms/moving-average.js';
+describe('Statistical Functions', () => {
+    describe('mean', () => {
+        it('calculates mean correctly', () => {
+            expect(mean([1, 2, 3, 4, 5])).toBe(3);
+            expect(mean([10, 20, 30])).toBe(20);
+            expect(mean([])).toBe(0);
+        });
+    });
+    describe('median', () => {
+        it('calculates median for odd-length arrays', () => {
+            expect(median([1, 2, 3, 4, 5])).toBe(3);
+            expect(median([5, 1, 3])).toBe(3);
+        });
+        it('calculates median for even-length arrays', () => {
+            expect(median([1, 2, 3, 4])).toBe(2.5);
+            expect(median([1, 2, 3, 4, 5, 6])).toBe(3.5);
+        });
+        it('returns 0 for empty arrays', () => {
+            expect(median([])).toBe(0);
+        });
+    });
+    describe('standardDeviation', () => {
+        it('calculates standard deviation correctly', () => {
+            const values = [2, 4, 4, 4, 5, 5, 7, 9];
+            const std = standardDeviation(values);
+            expect(std).toBeCloseTo(2, 1);
+        });
+        it('returns 0 for arrays with less than 2 elements', () => {
+            expect(standardDeviation([1])).toBe(0);
+            expect(standardDeviation([])).toBe(0);
+        });
+    });
+    describe('movingAverage', () => {
+        it('calculates moving average correctly', () => {
+            const values = [1, 2, 3, 4, 5];
+            const ma = movingAverage(values, 3);
+            expect(ma[0]).toBeNaN();
+            expect(ma[1]).toBeNaN();
+            expect(ma[2]).toBe(2); // (1+2+3)/3
+            expect(ma[3]).toBe(3); // (2+3+4)/3
+            expect(ma[4]).toBe(4); // (3+4+5)/3
+        });
+    });
+    describe('quantile', () => {
+        it('calculates quantiles correctly', () => {
+            const values = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+            expect(quantile(values, 0)).toBe(1);
+            expect(quantile(values, 0.5)).toBe(5.5);
+            expect(quantile(values, 1)).toBe(10);
+            expect(quantile(values, 0.25)).toBeCloseTo(3.25, 1);
+            expect(quantile(values, 0.75)).toBeCloseTo(7.75, 1);
+        });
+        it('handles edge cases', () => {
+            expect(quantile([], 0.5)).toBe(0);
+            expect(quantile([5], 0.5)).toBe(5);
+        });
+    });
+    describe('rollingQuantiles', () => {
+        it('calculates rolling quantiles correctly', () => {
+            const values = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+            const { lower, upper } = rollingQuantiles(values, 5, 0.1, 0.9);
+            // First 4 values should be NaN (not enough window data)
+            expect(lower[0]).toBeNaN();
+            expect(lower[3]).toBeNaN();
+            expect(upper[0]).toBeNaN();
+            expect(upper[3]).toBeNaN();
+            // From index 4 onwards, we should have valid quantiles
+            expect(lower[4]).toBeDefined();
+            expect(upper[4]).toBeDefined();
+            expect(lower[4]).toBeLessThan(upper[4]);
+        });
+    });
+});
+describe('Anomaly Detection Algorithms', () => {
+    const createDataPoints = (values) => values.map((value, index) => ({ index, value }));
+    const createDataPointsWithTimestamp = (values, baseTimestamp) => values.map((value, index) => ({
+        index,
+        value,
+        timestamp: baseTimestamp + index * 60 // 1 minute apart
+    }));
+    describe('Rolling Quantile Detection', () => {
+        it('detects outliers using rolling quantiles', () => {
+            // Values around 10, then a spike to 100
+            const values = [10, 11, 10, 12, 11, 10, 11, 10, 100, 11, 10];
+            const data = createDataPoints(values);
+            const anomalies = detectRollingQuantileAnomalies(data, {
+                window_size: 5,
+                lower_quantile: 0.05,
+                upper_quantile: 0.95,
+            });
+            expect(anomalies.length).toBeGreaterThan(0);
+            expect(anomalies.some(a => a.value === 100)).toBe(true);
+        });
+        it('returns no anomalies for uniform data', () => {
+            const data = createDataPoints([5, 5, 5, 5, 5, 5, 5, 5]);
+            const anomalies = detectRollingQuantileAnomalies(data, {
+                window_size: 3,
+            });
+            expect(anomalies.length).toBe(0);
+        });
+        it('throws error for invalid window size', () => {
+            const data = createDataPoints([1, 2, 3]);
+            expect(() => detectRollingQuantileAnomalies(data, { window_size: 0 })).toThrow('window_size must be greater than 0');
+        });
+        it('throws error when window is larger than data', () => {
+            const data = createDataPoints([1, 2, 3]);
+            expect(() => detectRollingQuantileAnomalies(data, { window_size: 10 })).toThrow('window_size (10) cannot be larger than data length (3)');
+        });
+        it('throws error for invalid quantile values', () => {
+            const data = createDataPoints([1, 2, 3, 4, 5]);
+            expect(() => detectRollingQuantileAnomalies(data, {
+                window_size: 3,
+                lower_quantile: 0.9,
+                upper_quantile: 0.1,
+            })).toThrow('lower_quantile must be less than upper_quantile');
+        });
+    });
+    describe('MAD Detection', () => {
+        it('detects outliers using MAD', () => {
+            const values = [10, 11, 10, 12, 11, 10, 11, 100];
+            const data = createDataPoints(values);
+            const anomalies = detectMadAnomalies(data, { threshold: 2 });
+            expect(anomalies.length).toBeGreaterThan(0);
+            expect(anomalies.some(a => a.value === 100)).toBe(true);
+        });
+        it('returns no anomalies for uniform data', () => {
+            const data = createDataPoints([5, 5, 5, 5, 5]);
+            const anomalies = detectMadAnomalies(data);
+            expect(anomalies.length).toBe(0);
+        });
+    });
+    describe('Threshold Detection', () => {
+        it('detects values crossing upper thresholds', () => {
+            const data = createDataPoints([10, 20, 30, 40, 50]);
+            const anomalies = detectThresholdAnomalies(data, {
+                thresholds: [
+                    { name: 'warning', value: 35, direction: 'upper' },
+                    { name: 'critical', value: 45, direction: 'upper' },
+                ],
+            });
+            expect(anomalies.length).toBe(2);
+            expect(anomalies[0].value).toBe(40);
+            expect(anomalies[0].crossed_thresholds).toContain('warning');
+            expect(anomalies[1].value).toBe(50);
+            expect(anomalies[1].crossed_thresholds).toContain('warning');
+            expect(anomalies[1].crossed_thresholds).toContain('critical');
+        });
+        it('detects values crossing lower thresholds', () => {
+            const data = createDataPoints([50, 40, 30, 20, 10]);
+            const anomalies = detectThresholdAnomalies(data, {
+                thresholds: [
+                    { name: 'min_healthy', value: 25, direction: 'lower' },
+                ],
+            });
+            expect(anomalies.length).toBe(2);
+            expect(anomalies[0].value).toBe(20);
+            expect(anomalies[1].value).toBe(10);
+        });
+        it('throws error when no thresholds provided', () => {
+            const data = createDataPoints([10, 20, 30]);
+            expect(() => detectThresholdAnomalies(data, { thresholds: [] })).toThrow('At least one threshold must be specified');
+        });
+    });
+    describe('Moving Average Detection', () => {
+        it('detects deviations from moving average', () => {
+            const values = [10, 10, 10, 10, 10, 500, 10, 10];
+            const data = createDataPoints(values);
+            const anomalies = detectMovingAverageAnomalies(data, {
+                window_size: 3,
+                threshold: 1,
+            });
+            expect(anomalies.length).toBeGreaterThan(0);
+        });
+        it('throws error for invalid window size', () => {
+            const data = createDataPoints([1, 2, 3]);
+            expect(() => detectMovingAverageAnomalies(data, { window_size: 0 })).toThrow('window_size must be greater than 0');
+        });
+        it('throws error when window is larger than data', () => {
+            const data = createDataPoints([1, 2, 3]);
+            expect(() => detectMovingAverageAnomalies(data, { window_size: 10 })).toThrow('window_size (10) cannot be larger than data length (3)');
+        });
+    });
+});
+describe('Anomaly Pooling', () => {
+    // Test pooling by importing the handler and running full detection
+    // This tests the integrated pooling behavior
+    const createDataPoints = (values) => values.map((value, index) => ({ index, value }));
+    it('pools consecutive anomalies together', () => {
+        // Create data where indices 3,4,5 are all above threshold
+        const data = createDataPoints([10, 10, 10, 100, 110, 105, 10, 10]);
+        const anomalies = detectThresholdAnomalies(data, {
+            thresholds: [{ name: 'high', value: 50, direction: 'upper' }],
+        });
+        // Should have 3 consecutive anomalies at indices 3, 4, 5
+        expect(anomalies.length).toBe(3);
+        expect(anomalies[0].index).toBe(3);
+        expect(anomalies[1].index).toBe(4);
+        expect(anomalies[2].index).toBe(5);
+    });
+    it('keeps separate pools for non-consecutive anomalies', () => {
+        // Create data where indices 1 and 5 are anomalies (not consecutive)
+        const data = createDataPoints([10, 100, 10, 10, 10, 100, 10]);
+        const anomalies = detectThresholdAnomalies(data, {
+            thresholds: [{ name: 'high', value: 50, direction: 'upper' }],
+        });
+        // Should have 2 separate anomalies at indices 1 and 5
+        expect(anomalies.length).toBe(2);
+        expect(anomalies[0].index).toBe(1);
+        expect(anomalies[1].index).toBe(5);
+    });
+});

package/dist/fileWriter/writer.js

@@ -275,7 +275,7 @@ export async function handleToolResponse(config, toolName, args, responseData) {
     // Generate tool_id for all responses
     const tool_id = generateToolId(toolName, args, config.toolAbbreviations);
     // Some tools should always return directly to AI (never write to file)
-    if (toolName === 'execute_jq_query' || toolName === 'get_label_schema') {
+    if (toolName === 'execute_jq_query' || toolName === 'get_label_schema' || toolName === 'detect_timeseries_anomalies') {
         const { contentToWrite, parsedForSchema } = extractContentForFile(responseData);
         return {
             tool_id,

package/dist/index.js

@@ -20,6 +20,7 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { createJqTool } from './jq/index.js';
+import { createTimeseriesTool } from './timeseries/index.js';
 import { truncateResponseIfNeeded } from './truncation/index.js';
 import { createFileWriter } from './fileWriter/index.js';
 import { generateToolId } from './utils/filename.js';
@@ -156,6 +157,12 @@ const ENABLE_JQ = process.env.MCP_PROXY_ENABLE_JQ !== 'false'; // default true
  * Timeout in milliseconds for JQ query execution
  */
 const JQ_TIMEOUT_MS = parseInt(process.env.MCP_PROXY_JQ_TIMEOUT_MS || '30000');
+/**
+ * MCP_PROXY_ENABLE_TIMESERIES (OPTIONAL, default: true)
+ * Enable the time series anomaly detection tool
+ * This tool allows detecting anomalies in time series data extracted from JSON files
+ */
+const ENABLE_TIMESERIES = process.env.MCP_PROXY_ENABLE_TIMESERIES !== 'false'; // default true
 /**
  * MCP_PROXY_SCHEMA_MAX_DEPTH (OPTIONAL, default: 3)
  * Maximum depth to traverse when generating query-assist schemas
@@ -243,6 +250,7 @@ if (ENABLE_LOGGING) {
         console.debug(`  Min chars for write: ${MIN_CHARS_FOR_WRITE}`);
     }
     console.debug(`  JQ tool enabled: ${ENABLE_JQ}`);
+    console.debug(`  Timeseries tool enabled: ${ENABLE_TIMESERIES}`);
     if (CHILD_COMMAND) {
         console.debug(`  Pass-through env vars: ${Object.keys(childEnv).length}`);
     }
@@ -327,6 +335,14 @@ async function main() {
             timeoutMs: JQ_TIMEOUT_MS
         });
     }
+    // Timeseries anomaly detection tool configuration
+    let timeseriesTool = null;
+    if (ENABLE_TIMESERIES) {
+        timeseriesTool = createTimeseriesTool({
+            allowedPaths: [process.cwd(), OUTPUT_PATH].filter(Boolean),
+            timeoutMs: JQ_TIMEOUT_MS // Uses same timeout as JQ since it runs jq internally
+        });
+    }
     // ------------------------------------------------------------------------
     // 5. REGISTER ALL TOOLS (CHILD + PROXY) WITH DESCRIPTION INJECTION
     // ------------------------------------------------------------------------
@@ -334,9 +350,11 @@ async function main() {
     const enhancedChildTools = childToolsResponse.tools.map(injectProxyParams);
     const allTools = [
         ...enhancedChildTools,
-        ...(jqTool ? [jqTool.toolDefinition] : []) // JQ tool already has description param
+        ...(jqTool ? [jqTool.toolDefinition] : []), // JQ tool already has description param
+        ...(timeseriesTool ? [timeseriesTool.toolDefinition] : []) // Timeseries tool already has description param
     ];
-    console.debug(`[mcp-proxy] Exposing ${allTools.length} tools total (${childToolsResponse.tools.length} from child${jqTool ? ' + 1 JQ' : ''})`);
+    const proxyToolCount = (jqTool ? 1 : 0) + (timeseriesTool ? 1 : 0);
+    console.debug(`[mcp-proxy] Exposing ${allTools.length} tools total (${childToolsResponse.tools.length} from child + ${proxyToolCount} proxy tools)`);
     // ------------------------------------------------------------------------
     // 6. HANDLE TOOL LIST REQUESTS
     // ------------------------------------------------------------------------
@@ -379,6 +397,39 @@ async function main() {
                     isError: result.isError
                 };
             }
+            // Handle Timeseries anomaly detection tool locally (if enabled)
+            if (toolName === 'detect_timeseries_anomalies' && timeseriesTool) {
+                if (ENABLE_LOGGING) {
+                    console.debug('[mcp-proxy] Executing Timeseries anomaly detection tool locally');
+                }
+                result = await timeseriesTool.handler({
+                    params: { arguments: toolArgs }
+                });
+                // Timeseries tool returns directly, wrap in unified format
+                const tool_id = generateToolId(toolName, toolArgs, fileWriterConfig.toolAbbreviations);
+                let outputContent = null;
+                if (result.content?.[0]?.text) {
+                    try {
+                        outputContent = JSON.parse(result.content[0].text);
+                    }
+                    catch {
+                        // If JSON parsing fails, use the raw text
+                        outputContent = result.content[0].text;
+                    }
+                }
+                const unifiedResponse = {
+                    tool_id,
+                    wroteToFile: false,
+                    outputContent
+                };
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(unifiedResponse, null, 2)
+                        }],
+                    isError: result.isError
+                };
+            }
             // Forward all other tools to child MCP (if child exists)
             if (!childClient) {
                 const tool_id = generateToolId(toolName, toolArgs, fileWriterConfig.toolAbbreviations);

package/dist/jq/handler.js

@@ -1,7 +1,7 @@
-import { spawn } from 'child_process';
 import { existsSync } from 'fs';
 import path from 'path';
 import { validatePathWithinAllowedDirs } from '../utils/pathValidation.js';
+import { validateJqQuery, runJq } from '../utils/jq.js';
 // Default timeout for JQ execution
 const DEFAULT_TIMEOUT_MS = 30000;
 /**
@@ -17,19 +17,7 @@ export async function executeJqQuery(config, jqQuery, filePath) {
         throw new Error('jq_query and file_path are required');
     }
     // Sanitize jq query to prevent environment variable access
-    const dangerousPatterns = [
-        /\$ENV/i, // $ENV variable access
-        /env\./i, // env.VARIABLE access
-        /@env/i, // @env function
-        /\.env\[/i, // .env["VARIABLE"] access
-        /getenv/i, // getenv function
-        /\$__loc__/i, // location info that might leak paths
-        /input_filename/i, // input filename access
-    ];
-    const isDangerous = dangerousPatterns.some((pattern) => pattern.test(jqQuery));
-    if (isDangerous) {
-        throw new Error('The jq query contains patterns that could access environment variables or system information. Please use a different query.');
-    }
+    validateJqQuery(jqQuery);
     // Validate file path
     if (!path.isAbsolute(filePath)) {
         throw new Error(`File path must be an absolute path starting with "/": ${filePath}`);
@@ -46,46 +34,13 @@ export async function executeJqQuery(config, jqQuery, filePath) {
     validatePathWithinAllowedDirs(filePath, config.allowedPaths);
     // Execute jq query
     const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    return new Promise((resolve, reject) => {
-        const jqProcess = spawn('jq', [jqQuery, filePath], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            timeout: timeoutMs,
-        });
-        let stdout = '';
-        let stderr = '';
-        jqProcess.stdout.on('data', (data) => {
-            stdout += data.toString();
-        });
-        jqProcess.stderr.on('data', (data) => {
-            stderr += data.toString();
-        });
-        jqProcess.on('close', (code) => {
-            if (code === 0) {
-                // Success - return clean response directly to AI
-                const responseText = stdout.trim();
-                resolve({
-                    content: [
-                        {
-                            type: 'text',
-                            text: responseText,
-                        },
-                    ],
-                });
-            }
-            else {
-                // Error
-                reject(new Error(`jq command failed with exit code ${code}: ${stderr.trim()}`));
-            }
-        });
-        jqProcess.on('error', (error) => {
-            reject(new Error(`Failed to execute jq command: ${error.message}`));
-        });
-        // Handle timeout
-        setTimeout(() => {
-            if (!jqProcess.killed) {
-                jqProcess.kill('SIGTERM');
-                reject(new Error(`jq command timed out after ${timeoutMs}ms`));
-            }
-        }, timeoutMs);
-    });
+    const responseText = await runJq(jqQuery, filePath, timeoutMs);
+    return {
+        content: [
+            {
+                type: 'text',
+                text: responseText,
+            },
+        ],
+    };
 }

package/dist/timeseries/algorithms/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Anomaly detection algorithms index
+ */
+export * from './stats.js';
+export { detectMadAnomalies } from './mad.js';
+export { detectMovingAverageAnomalies } from './moving-average.js';
+export { detectThresholdAnomalies } from './threshold.js';
+export { detectRollingQuantileAnomalies } from './rolling-quantile.js';

package/dist/timeseries/algorithms/index.js

@@ -0,0 +1,8 @@
+/**
+ * Anomaly detection algorithms index
+ */
+export * from './stats.js';
+export { detectMadAnomalies } from './mad.js';
+export { detectMovingAverageAnomalies } from './moving-average.js';
+export { detectThresholdAnomalies } from './threshold.js';
+export { detectRollingQuantileAnomalies } from './rolling-quantile.js';

package/dist/timeseries/algorithms/mad.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Median Absolute Deviation (MAD) based anomaly detection
+ *
+ * Uses modified Z-scores based on median and MAD instead of mean and std dev.
+ * Most robust to outliers, excellent for non-normal distributions.
+ */
+import type { DataPoint, Anomaly, MadParams } from '../types.js';
+/**
+ * Detect anomalies using MAD method
+ *
+ * @param data - Array of data points
+ * @param params - MAD parameters
+ * @returns Array of detected anomalies
+ */
+export declare function detectMadAnomalies(data: DataPoint[], params?: MadParams): Anomaly[];

package/dist/timeseries/algorithms/mad.js

@@ -0,0 +1,44 @@
+/**
+ * Median Absolute Deviation (MAD) based anomaly detection
+ *
+ * Uses modified Z-scores based on median and MAD instead of mean and std dev.
+ * Most robust to outliers, excellent for non-normal distributions.
+ */
+import { median, medianAbsoluteDeviation, modifiedZScore } from './stats.js';
+const DEFAULT_THRESHOLD = 3;
+/**
+ * Detect anomalies using MAD method
+ *
+ * @param data - Array of data points
+ * @param params - MAD parameters
+ * @returns Array of detected anomalies
+ */
+export function detectMadAnomalies(data, params = {}) {
+    const threshold = params.threshold ?? DEFAULT_THRESHOLD;
+    const values = data.map((d) => d.value);
+    const med = median(values);
+    const mad = medianAbsoluteDeviation(values);
+    if (mad === 0) {
+        // All values are at the median, no anomalies possible
+        return [];
+    }
+    const anomalies = [];
+    for (const point of data) {
+        const modZ = modifiedZScore(point.value, med, mad);
+        const absModZ = Math.abs(modZ);
+        if (absModZ > threshold) {
+            anomalies.push({
+                index: point.index,
+                timestamp: point.timestamp,
+                value: point.value,
+                reason: `Modified Z-score ${modZ.toFixed(2)} exceeds threshold ±${threshold}`,
+                metadata: {
+                    modified_zscore: modZ,
+                    median: med,
+                    mad,
+                },
+            });
+        }
+    }
+    return anomalies;
+}

package/dist/timeseries/algorithms/moving-average.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Moving Average based anomaly detection
+ *
+ * Detects points that deviate significantly from a rolling moving average.
+ * Good for detecting sudden changes in time series with trends.
+ */
+import type { DataPoint, Anomaly, MovingAverageParams } from '../types.js';
+/**
+ * Detect anomalies using Moving Average method
+ *
+ * @param data - Array of data points (should be in time order)
+ * @param params - Moving Average parameters
+ * @returns Array of detected anomalies
+ */
+export declare function detectMovingAverageAnomalies(data: DataPoint[], params: MovingAverageParams): Anomaly[];

package/dist/timeseries/algorithms/moving-average.js

@@ -0,0 +1,72 @@
+/**
+ * Moving Average based anomaly detection
+ *
+ * Detects points that deviate significantly from a rolling moving average.
+ * Good for detecting sudden changes in time series with trends.
+ */
+import { movingAverage, movingStandardDeviation } from './stats.js';
+const DEFAULT_THRESHOLD = 2;
+/**
+ * Detect anomalies using Moving Average method
+ *
+ * @param data - Array of data points (should be in time order)
+ * @param params - Moving Average parameters
+ * @returns Array of detected anomalies
+ */
+export function detectMovingAverageAnomalies(data, params) {
+    const { window_size: windowSize, threshold = DEFAULT_THRESHOLD } = params;
+    if (windowSize <= 0) {
+        throw new Error('window_size must be greater than 0');
+    }
+    if (windowSize > data.length) {
+        throw new Error(`window_size (${windowSize}) cannot be larger than data length (${data.length})`);
+    }
+    const values = data.map((d) => d.value);
+    const ma = movingAverage(values, windowSize);
+    const mstd = movingStandardDeviation(values, windowSize);
+    const anomalies = [];
+    for (let i = 0; i < data.length; i++) {
+        // Skip points where we don't have enough data for the window
+        if (isNaN(ma[i]) || isNaN(mstd[i])) {
+            continue;
+        }
+        const point = data[i];
+        const expectedValue = ma[i];
+        const stdDev = mstd[i];
+        // If standard deviation is 0, all values in window are the same
+        if (stdDev === 0) {
+            // Only flag as anomaly if current value differs from the constant
+            if (point.value !== expectedValue) {
+                anomalies.push({
+                    index: point.index,
+                    timestamp: point.timestamp,
+                    value: point.value,
+                    reason: `Value ${point.value} differs from constant window value ${expectedValue}`,
+                    metadata: {
+                        moving_average: expectedValue,
+                        moving_std_dev: stdDev,
+                        window_size: windowSize,
+                    },
+                });
+            }
+            continue;
+        }
+        const deviation = Math.abs(point.value - expectedValue);
+        const deviationScore = deviation / stdDev;
+        if (deviationScore > threshold) {
+            anomalies.push({
+                index: point.index,
+                timestamp: point.timestamp,
+                value: point.value,
+                reason: `Value deviates ${deviationScore.toFixed(2)} std devs from moving average (expected: ${expectedValue.toFixed(2)}, threshold: ${threshold})`,
+                metadata: {
+                    moving_average: expectedValue,
+                    moving_std_dev: stdDev,
+                    deviation_score: deviationScore,
+                    window_size: windowSize,
+                },
+            });
+        }
+    }
+    return anomalies;
+}

package/dist/timeseries/algorithms/rolling-quantile.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Rolling Quantile based anomaly detection (similar to Datadog's Basic algorithm)
+ *
+ * Uses a sliding window to compute rolling percentiles, then flags points
+ * outside the expected range. This is non-parametric and works well for
+ * any distribution without assuming normality.
+ */
+import type { DataPoint, Anomaly, RollingQuantileParams } from '../types.js';
+/**
+ * Detect anomalies using Rolling Quantile method
+ *
+ * @param data - Array of data points (should be in time order)
+ * @param params - Rolling Quantile parameters
+ * @returns Array of detected anomalies
+ */
+export declare function detectRollingQuantileAnomalies(data: DataPoint[], params: RollingQuantileParams): Anomaly[];