PyOD

PyOD is a free, open-source Python library for detecting anomalies across several kinds of data. It is best suited to developers and researchers who want a broad detector toolkit they can run in their own Python workflows. Its breadth and orchestration are compelling, but anomaly scores still need validation against labels or domain expertise.

Overview

Initialized in 2017, PyOD brings 61 detectors for tabular, time-series, graph, text, image, and audio data behind one API. It supports hybrid detection, real-time detection, self-hosted deployment, and anomaly explanations. That makes it a flexible foundation for building anomaly detection into a product or analysis pipeline, rather than a turnkey monitoring service.

Users can work with the classic detector API, use ADEngine to coordinate detector selection and execution, or draw on an agent-oriented investigation workflow. The range is useful when a project may span different data types or methods, though some capabilities depend on optional packages and the project requires Python 3.9 or higher.

Key features

Detector catalog and orchestration

The catalog spans six data types, and its detectors share a common API. ADEngine adds profiling, benchmark-backed detector selection, parallel runs, consensus scores, and diagnostic reporting. This can reduce the work of coordinating multiple detectors, especially when an analyst wants a comparative view; its quality verdict is a heuristic, not a guarantee, so it should not replace checks against held-out labels or domain review.

Python and agent workflows

ADEngine works as a standalone Python API without an LLM. For agent workflows, PyOD provides an od-expert skill for Claude Code and Codex, along with an optional MCP server for compatible agents. The installation guide also describes activation paths for Claude Code, Codex, and MCP-compatible agents. These options suit teams already building with those tools, while the conventional API keeps PyOD usable without them.

Extensions and safe model loading

Optional pip extras cover PyTorch and graph detectors, embeddings, audio, MCP, and integrations including SUOD, XGBoost, model combination, and thresholding. The breadth is valuable, but users need to choose and install extras for optional capabilities. PyOD warns that pickle and joblib can deserialize arbitrary Python code; loading saved artifacts requires callers to pass trusted=True, so those files should only be trusted when their origin is trusted.

Pricing

PyOD — free. The plan is an open-source Python library, with optional capabilities requiring pip extras. There is no free-trial period because the library itself is free. The practical cost is assembling and maintaining the Python environment and any optional dependencies; the project does not state a paid support plan. Installation is available through pip, conda-forge, or from source.

Platforms

PyOD supports Linux, macOS, and Windows, as well as API and self-hosted use. It is a Python library rather than a hosted end-user application, so it fits teams prepared to integrate and operate software in their own environment.

Who it's for

PyOD is a strong fit for data scientists, researchers, and product teams that need anomaly detection inside Python applications or analysis pipelines, particularly when they work across more than one data type. It is less suitable for buyers seeking a managed interface, a paid support commitment, or a result-quality guarantee. The project says it serves academic research and commercial products; contributors proposing new detectors are expected to commit to at least two years of maintenance.

Pros and cons

• Pro: Broad detector coverage. Sixty-one detectors share one API across tabular, time-series, graph, text, image, and audio data.
• Pro: Multiple ways to work. The classic API, ADEngine orchestration, and agent-oriented workflows support different development styles, and ADEngine does not require an LLM.
• Pro: Free and self-hosted. The library can be installed from common Python package channels or source and run on Linux, macOS, or Windows.
• Con: Optional features add setup work. Extra capabilities require additional pip extras, so the full catalog is not a single minimal installation.
• Con: Quality still needs human or labeled-data checks. ADEngine calls its verdict heuristic and recommends validation with held-out labels or domain review.
• Con: Saved models carry a security risk. Pickle and joblib artifacts can execute arbitrary Python code when loaded, requiring care with trusted inputs.

Alternatives

For a different focus, consider PySAD, also a free open-source Python framework, or ManageEngine NetFlow Analyzer, which offers a free edition limited to two interfaces and paid editions starting at $172 a month for 10 interfaces. For pipeline testing and data observability, Soda has a free plan with pipeline testing, metrics observability, and alerting and ticketing integrations. Metaplane may suit teams wanting hosted data monitoring: its free plan covers 10 monitored tables, four users, and three custom SQL monitors.

ObservabilityOS offers a source-available, self-hosted option with a free developer plan capped at one service, 500MB of logs per month, and seven-day retention. For security-focused detection, Corelight Open NDR, Securonix UEBA, and Vectra AI Identity Threat Detection and Response are paid alternatives.

Browse more options in Anomaly Detection Software.

Verdict

Choose PyOD if you want a free, self-hosted Python toolkit with a wide detector catalog and orchestration that can help compare methods across varied data. Its strongest advantage is flexibility within a Python workflow; its main limitation is that neither detector consensus nor ADEngine’s heuristic removes the need to validate results. Look elsewhere if you need managed monitoring, committed paid support, or a guarantee of detection quality.