Struct BehavioralTracker 

pub struct BehavioralTracker { /* private fields */ }

Tracks per-agent tool call frequency patterns and detects anomalies.

Uses exponential moving average (EMA) — deterministic, auditable, no ML. Designed to detect behavioral shifts like an agent suddenly making 500 read_file calls when the historical average is 5.

Implementations

impl BehavioralTracker

pub fn new(config: BehavioralConfig) -> Result<Self, BehavioralError>

Create a new tracker. Returns an error if the configuration is invalid.

pub fn check_session( &self, agent_id: &str, call_counts: &HashMap<String, u64>, ) -> Vec<AnomalyAlert>

pub fn record_session( &mut self, agent_id: &str, call_counts: &HashMap<String, u64>, )

Update baselines after a session completes.

Call this with the final call counts when a session ends. Tools with zero counts are ignored for recording but existing baselines for tools not present in call_counts are decayed toward zero.

pub fn get_baseline(&self, agent_id: &str, tool: &str) -> Option<&ToolBaseline>

Get the baseline for a specific agent and tool.

pub fn agent_sessions(&self, agent_id: &str) -> Option<u32>

Get the total sessions recorded for an agent.

pub fn agent_count(&self) -> usize

Number of agents being tracked.

pub fn tool_count(&self, agent_id: &str) -> usize

Number of tools tracked for a specific agent.

pub fn config(&self) -> &BehavioralConfig

Access the current configuration.

pub fn snapshot(&self) -> BehavioralSnapshot

Create a serializable snapshot of all tracking state.

pub fn from_snapshot( config: BehavioralConfig, snapshot: BehavioralSnapshot, ) -> Result<Self, BehavioralError>

Restore from a persisted snapshot.

Validates that all EMA values are finite and non-negative.