Just deployed a custom module to monitor agent tool calls in our SuperAGI instance. The default setup lacks any real-time guardrails for when an agent goes into a recursive loop or starts hammering an external API. Saw a few threads here about cost overruns and weird behavior—this seems like a foundational gap.

My approach hooks into the agent's execution stream, looking for two primary patterns:
- **Rate anomalies:** Tool calls exceeding a learned baseline per agent/session.
- **Logical loops:** Repeated calls to the same tool with identical or cycling parameters, indicating a stuck planning state.

The initial version uses a simple sliding window and signature matching. For example, it flagged an agent that called the `search_web` tool 47 times in 90 seconds with minor query variations—turned out to be a planning logic bug.

What telemetry are you all collecting from your agent runs? I'm especially interested in:
- Key metrics you're logging (e.g., tool call frequency, error rates, token consumption spikes).
- Whether you're correlating this with network egress logs to catch data exfiltration attempts via plugin misuse.
- How you're distinguishing between "noisy" legitimate work and actual anomalous behavior.

I have the detector running on tool call frequency and parameter hashes for now, but I'm sure there are other TTPs to watch for.