gcp-cost-anomaly-scanlisted

# GCP Cost Anomaly Scan (READ-ONLY) ## Overview For every billing account the caller can see, determines whether any project has experienced an abnormal spend spike in the last `LOOKBACK_DAYS` days (default 60). Uses the `gcp-finops` MCP server when available; otherwise falls back to direct `bq query` against billing-export tables. > **Related native feature (July 2026):** Google's [Early Anomalies](https://docs.cloud.google.com/billing/docs/how-to/manage-anomalies#view-early-anomalies) (Preview) now does forward-looking, pre-invoice anomaly alerting with root-cause SKU attribution — but only for Gemini API, Agent Platform, Cloud Run, and Cloud Run functions, per project, in the console's Anomalies section. This skill remains the historical sweep across *all* services and billing accounts, and produces the `anomalies.json` later phases consume. When reporting, mention enabling Early Anomalies review as a complementary forward-looking control. ## When to Use - Triggered by the `gcp-ironclad` driver as Phase 1b. - Or invoked standalone when you suspect past abuse you may have missed. ## Inputs - `SESSION_DIR` env var. - `LOOKBACK_DAYS` env var (default `60`). - `THRESHOLD_PCT` env var (default `200` — daily spend must be ≥200% over the 7-day rolling average to flag). - `ACTIVE_HOURS` env var (default `24` — used to mark anomalies as still-active). ## Outputs Writes `${SESSION_DIR}/anomalies.json` matching `output.schema.json`. ## Execution ### Step A: Establish sessi