Event types
Thetype field is one of:
The SDK chooses the right type automatically based on what fired the hook.
Event payload
Every event includes:What gets captured at each privacy level
Token counts and USD spend are pure numerics — they pass through every level unchanged. The dashboard’s KPIs and charts work identically regardless of which level you pick. See the privacy overview for the full breakdown.
Cost attribution
Voight computes USD cost per event from the token breakdown:- Path A — exact (
metadata.tokensBreakdownfrom SDK 0.3.3+): each token flavour priced at its real rate.cacheReadat 0.10× base input,cacheCreationat 1.25× base,inputBaseat 1.00×,outputat the output rate. - Path B — heuristic (
metadata.tokenswithsource: 'claude-code'): assumes 95% of input iscache_read, applies approximate discount. Used as fallback for older SDK versions. - Path C — flat (library callers): no breakdown, prices
inputandoutputat full rates.
Anomaly detection
A scheduler runs every 5 minutes and computes 4 anomaly rules per agent over the last 7 days:
When triggered, an
Alert row is created/updated with severity (low / medium / high based on deviation), dedup by <type>|<agentId> fingerprint. Alerts have a full lifecycle: triggeredAt, lastTriggeredAt, acknowledgedAt, snoozedUntil, resolvedAt.
Alert delivery channels (Telegram, email, webhooks) ship in v1.0. Today alerts persist + surface in the dashboard’s Alerts page.
Pre/Post pairing
Each tool call fires two hook events from Claude Code:PreToolUse(before execution) — outcomepending, fingerprintsessionId|toolName|toolInputPostToolUse(after execution) — same fingerprint, withdurationMsandoutcomefilled in
PreToolUse is orphaned for >120s (no matching Post), Voight classifies it as orphanedPre and counts it toward the error rate.