Data Sources, Inventory, Tool Surface and Identity Graph

What the four Intelligence pages show about your hosts, the AI on them, the tools agents called, and how they connect.

The Intelligence section answers four questions. Which hosts report, and through which layers: Data Sources. What AI exists on the fleet: Inventory. What agents actually called: Tool Surface. How humans, agents, tools and data connect: Identity Graph. Each page shows what the sensor could read; an empty page means nothing was captured, not that nothing exists.

​

Data Sources

The subtitle: “Independent telemetry sources · 4 layers · judged per host, on live hosts only”. Tiles: Hosts live, Events · today, Endpoint Security live, Proxy intercept live, Degraded hosts.

Capture layers are the four independent ways a host records activity.

Layer	What it records, in plain words
Endpoint Security	File and process activity, recorded by the operating system.
Proxy (MITM)	The agent’s requests to its model provider, through a local HTTPS proxy. This is where declared intent is read.
Network Extension	Outbound connections as flows: destination, port and the process that opened them. Locked in place by an MDM profile.
OpenTelemetry	Spans and metrics an agent emits about itself, received over OTLP.

Telemetry by host lists every enrolled host: Host, User, OS, Agents, Events today, Capture layers, Last seen. The filter row has All, Silent, Degraded and Fleet. Use Silent and Degraded to find hosts whose capture needs attention. A silent host has recorded nothing, which is not the same as nothing happening on it. Empty: “No hosts enrolled yet.”

The Deploy sensors card is where installers are offered. Your Quint contact provides the package and its checksum. See Platform support.

​

Host detail

Facts: OS, User, Sensor, Serial, Heartbeat, Events today, Active agents, Capture lanes, Install integrity, Last tamper check. Agents on this host: Agent, Platform, Class, Last seen, Status. Root sessions: Session, Working dir, Agent, Actions, Started, State. The list is ordered by start time, newest first.

When a host has gone quiet the page says so: “Lane states are last-known readings — this host has not reported for over 24h.” Read those lane states as history, not as the present.

​

Inventory

Inventory lists everything AI that exists on the fleet, from each machine’s own vantage: the runtime platforms agents execute on, and the MCP servers each machine declares in its config files, reconciled against what was observed running. What was actually called is a different question and lives on Tool Surface.

Runtimes tab. Tiles Platforms, Hosts with AI, Sessions, Live now; panels Fleet coverage, First identified, Runtime platforms. Empty: “No AI platforms identified on the fleet yet.” with “Once a sensor matches an agent’s process to a platform signature, it is listed here with its hosts, sessions and models”, counted over the selected time window.

MCP Servers tab. Tiles Undeclared, Dormant, Running, Declared; Remote is a filter chip, not a tile.

State	What it means
Declared	A machine’s config files name the server.
Running	The machine observed the server running.
Dormant	Declared, but not observed running.
Undeclared	Observed running, but named in no config file.

The table is marked “Reconciled against tool calls”: Server, Machine, Client, Transport, State, Called, Last exec, Evidence, Fleet. A banner stays above it: “This inventory is incomplete.” with “The rows below are what the sensor could read, not necessarily everything that exists.”

​

Tool Surface

The page refreshes live (“live · 15s refresh”) and says what it is built from: “Servers appear here the moment an agent calls one of their tools. Nothing is listed from configuration — this registry is built from observed traffic only.”

Tiles: MCP servers reached (“discovered from captured tool calls”), Distinct tools exercised (“every tool an agent actually invoked”), Tool calls · window (“last 24h”), Sessions using MCP (“agent sessions that reached a server”), Blocked calls (“BLOCK decisions in this window”).

Busiest servers is “Ranked by observed tool calls · discovered from traffic, not declared in config”. The MCP server registry lists Server, Tools, Calls, Decisions, Estate and Last call, with “Filter by server or tool…”, a time window and Expand on each row. From a row, Write a rule for this server, Write a rule for these tools or Write a rule for this tool starts a rule for what you selected; see Write and publish a rule. view in inventory opens the same server on Inventory. Empty: “No MCP tool calls captured in this window.”

​

Identity Graph

Three lenses: Trust (humans, agents, tools and data), Lineage (who started whom) and All (every captured relationship). Controls: a time window, “Search the graph…”, Graph or Table mode, an Undeclared agents toggle, an inspector and saved views.

Tiles: Humans attributed, Agents indexed, Tools reached, Credential-grade paths. The coverage banner qualifies them: totals are “upper bounds, not exact counts”, and when “a query hit its row cap — totals are a floor, not exact”. Narrow the window before you quote a total.

Empty: “No agents discovered yet.” with “Once the sensor observes agent processes on the fleet, the trust surface renders here.”

Every member who can see these pages can read them; the only write is the rule started from Tool Surface.

​

Next

• Verify and troubleshoot when a host is silent or degraded.
• Sessions, Live Activity and Agents for what the agents on those hosts did.