Monitor Agents & MCPs

Once endpoints are checking in and approved MCPs are installed, the control-plane dashboard is where you watch the fleet. This guide tours the views and the questions each one answers.

Fleet

Fleet → Overview rolls up the whole estate from GET /admin/fleet/metrics: device counts by status, agent counts, and MCP adoption. Use it as the daily health glance.

Fleet → Devices (/admin/fleet/devices) lists every device — serial, owner, status, version, and MCP count. Drill into a device to see its identity, registration state, change history, and last inventory snapshot.

Fleet → Agents (/admin/fleet/agents) shows each discovered agent type with its device and MCP counts. Click through to the devices running that agent, or the MCPs it reaches.

Fleet → Graph (/admin/fleet/graph) renders the network of agents, devices, and MCP servers from GET /admin/fleet/graph. It’s the fastest way to spot an MCP that’s reachable from more of the fleet than you intended.

flowchart LR
  Fleet["Fleet"]
  Fleet --> Overview["Overview\nhealth at a glance"]
  Fleet --> Devices["Devices\nwho has what"]
  Fleet --> Agents["Agents\nadoption by agent type"]
  Fleet --> Graph["Graph\nagent ↔ MCP reachability"]

MCP servers

MCP Servers (/admin/mcp-servers) lists every MCP seen across the fleet with its configured-vs-enabled device counts. Open one (/admin/mcp-servers/:id) for its description, transports, the agent-support matrix, and usage statistics (GET /admin/mcps/:mcpName/usage). The known-MCP registry (GET /admin/mcps/known) enriches these with friendly descriptions and expected tools.

This is where you answer “who can reach the postgres MCP, and how heavily is it used?”

Observability

Observability → Summary (/admin/observability/summary) gives the aggregate picture: total events, the allowed/denied/error split, summed input/output tokens, and the count of unique MCP servers.

Observability → Events (/admin/observability/events) is the event browser — a paginated, filterable list of individual MCP tool calls. Filter by:

• date range,
• agent type,
• MCP name,
• result (allowed / denied / error),
• deny code.

Each row shows the agent, device owner, MCP, tool, result, tokens, and duration. This is your starting point for investigating a spike in denials or a costly agent. The field-by-field meaning is in the event schema reference.

Common questions and where to look

Question	View
Are all my endpoints healthy and reporting?	Fleet → Overview / Devices
Which agents are most common across the fleet?	Fleet → Agents
Which MCP servers are reachable from where?	Fleet → Graph, MCP Servers
How much is a given MCP used, and how often denied?	MCP Servers → detail
What did this agent/user actually call?	Observability → Events (filter)
How many tokens is agent traffic consuming?	Observability → Summary

Next: lock things down and prove compliance in Audit & Compliance.