GA4 Anomaly Detector

What it does

GA4 Anomaly Detector monitors Google Analytics 4 metric time-series (sessions, total users, conversions, and any GA4 metric you choose) and flags days that deviate from a rolling baseline. Detection is deterministic — z-score (default, threshold 3) or IQR — and every number (value, expected, deviation, score, severity, confidence) is code-derived. An LLM only narrates the already-computed anomalies into a readable alert; it never produces a number and never asserts a definitive cause. Without an API key (and no host sampling) it degrades gracefully to a deterministic template. It runs as a collect → analyze → narrate → report loop. Connector-ready: with an optional GA4 property ID + read-only service-account key it can pull live series from the GA4 Data API (sandbox/test property recommended); otherwise it runs fully on mock data or your own caller-provided series / GA4 runReport export — so you can try it with zero setup. Guardrails: read-only, egress is allowlisted to the GA4 Data API host, prompt-injection is defanged, credentials are masked and never logged, and the output is decision-support (no fabricated causes). Tools: - run_full — end-to-end: collect (mock/provided/live), detect deterministically, narrate, return the full AgentResult JSON. - detect_anomalies — pure deterministic detection over ready MetricSeries[] (no LLM), with optional sensitivity. - analyze — lower-level: run the analyzer over a full RawData object (series + method). - connector_status — GA4 connector readiness: required slots, egress host, and whether live credentials are present (secret-safe). - list_capabilities — static capabilities: tools, detection methods, default metrics, credential slots. - plan_inputs — interview helper returning questions, JSON schema, and a ready-to-edit example for a tool. Array/object arguments may be passed as JSON or a JSON string. Missing required inputs return a structured needs_input payload (questions + schema + example) instead of erroring, and upgrade to a native elicitation form on clients that support it.

Example prompts

• Run run_full on the mock data with z-score sensitivity 3 and summarize any critical anomalies.
• I have my own GA4 series — detect_anomalies over this MetricSeries[] using IQR sensitivity and return the scored anomalies.
• Check connector_status: which credential slots and egress host does this agent need, and are live credentials present?