Last month I ran hundreds of LangChain agent calls in production. Some of them silently failed by using wrong tool sequences, latency spikes, or even hallucinated outputs. My logs showed zero errors. No exceptions. No warnings.
The agent just did the wrong thing, quietly.
Traditional monitoring tools weren't built for this. Datadog can tell you a function threw an exception. It can't tell you your agent called delete_file when it's never done that before, or that your LLM is suddenly generating 10x more tokens than usual, or that output quality has been slowly degrading over the last 500 runs.
So I built Drift.
What Drift Does
Drift hooks into your agent's execution and applies statistical anomaly detection to the event stream in real time. Three detectors run simultaneously:
Latency & token SPC — Uses rolling z-scores to flag when a tool call or LLM response takes significantly longer or uses significantly more tokens than its baseline. Catches hung API calls, runaway generation, and upstream provider issues.
Sequence anomaly detection — Builds a Markov transition matrix of tool-call sequences and flags when the agent takes a path that's never or rarely been seen. Catches agents going off-script, skipping required steps, or making dangerous tool calls they've never made before.
Output drift detection — Tracks output length, vocabulary diversity, and structural patterns over time. Flags when outputs shift significantly from baseline. Catches hallucination drift, prompt injection effects, and gradual quality degradation.
Three Lines to Add It
bash
pip install drift-detection
python
`from drift import DriftGuard
from drift.callbacks.langchain import DriftCallbackHandler
guard = DriftGuard(on_anomaly=lambda a: print(f"🚨 {a}"))
handler = DriftCallbackHandler(guard)
agent.run("your query", callbacks=[handler])
guard.report()`
DRIFT DEMO — Agent Anomaly Detection
[Phase 1] Building baseline with 20 normal agent runs...
✓ 120 events processed, 0 anomalies
[Phase 2] Injecting anomalies...
--- Injecting: Latency spike on 'search_web' ---
🚨 [CRITICAL] latency_spike: 'search_web' latency is 2500.0ms,
76.3σ above mean (200.7ms ± 30.1)
--- Injecting: Novel tool sequence (search_web → delete_file) ---
🚨 [HIGH] sequence_anomaly: Novel transition: 'search_web' → 'delete_file'
(never observed; known transitions: ['parse_document'])
--- Injecting: Output drift on 'write_response' ---
🚨 [CRITICAL] token_anomaly: 'write_response' token_count is 2000 tokens,
66.5σ above mean (107.8 ± 28.5) 🚨 [HIGH] output_drift: output_length is 3014 chars, 43.3σ above baseline
🚨 [MEDIUM] output_drift: novel structure 'code_block' (seen: ['plain_text'])` The latency spike at 76σ. The delete_file call never seen before. The token count 18x baseline. All caught automatically.
Design Decisions
What's Coming
Try It
bashpip install drift-detection
GitHub: GitHub: dombinic/Drift Star it if it's useful. Open an issue if you want a feature — I read everything.