> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Sources, Inventory, Tool Surface and Identity Graph

> What the four Intelligence pages show about your hosts, the AI on them, the tools agents called, and how they connect.

The **Intelligence** section answers four questions. Which hosts report, and through which layers: **Data Sources**. What AI exists on the fleet: **Inventory**. What agents actually called: **Tool Surface**. How humans, agents, tools and data connect: **Identity Graph**. Each page shows what the sensor could read; an empty page means nothing was captured, not that nothing exists.

## Data Sources

The subtitle: "Independent telemetry sources · 4 layers · judged per host, on live hosts only". Tiles: **Hosts live**, **Events · today**, **Endpoint Security live**, **Proxy intercept live**, **Degraded hosts**.

**Capture layers** are the four independent ways a host records activity.

| Layer | What it records, in plain words |
| - | - |
| **Endpoint Security** | File and process activity, recorded by the operating system. |
| **Proxy (MITM)** | The agent's requests to its model provider, through a local HTTPS proxy. This is where declared intent is read. |
| **Network Extension** | Outbound connections as flows: destination, port and the process that opened them. Locked in place by an MDM profile. |
| **OpenTelemetry** | Spans and metrics an agent emits about itself, received over OTLP. |

**Telemetry by host** lists every enrolled host: **Host**, **User**, **OS**, **Agents**, **Events today**, **Capture layers**, **Last seen**. The filter row has **All**, **Silent**, **Degraded** and **Fleet**. Use **Silent** and **Degraded** to find hosts whose capture needs attention. A silent host has recorded nothing, which is not the same as nothing happening on it. Empty: "No hosts enrolled yet."

The **Deploy sensors** card is where installers are offered. Your Quint contact provides the package and its checksum. See [Platform support](https://docs.quintai.dev/install/platform-support.md).

### Host detail

Facts: **OS**, **User**, **Sensor**, **Serial**, **Heartbeat**, **Events today**, **Active agents**, **Capture lanes**, **Install integrity**, **Last tamper check**. **Agents on this host**: **Agent**, **Platform**, **Class**, **Last seen**, **Status**. **Root sessions**: **Session**, **Working dir**, **Agent**, **Actions**, **Started**, **State**. The list is ordered by start time, newest first.

When a host has gone quiet the page says so: "Lane states are last-known readings — this host has not reported for over 24h." Read those lane states as history, not as the present.

## Inventory

**Inventory** lists everything AI that exists on the fleet, from each machine's own vantage: the runtime platforms agents execute on, and the MCP servers each machine declares in its config files, reconciled against what was observed running. What was actually called is a different question and lives on **Tool Surface**.

**Runtimes** tab. Tiles **Platforms**, **Hosts with AI**, **Sessions**, **Live now**; panels **Fleet coverage**, **First identified**, **Runtime platforms**. Empty: "No AI platforms identified on the fleet yet." with "Once a sensor matches an agent's process to a platform signature, it is listed here with its hosts, sessions and models", counted over the selected time window.

**MCP Servers** tab. Tiles **Undeclared**, **Dormant**, **Running**, **Declared**; **Remote** is a filter chip, not a tile.

| State | What it means |
| - | - |
| **Declared** | A machine's config files name the server. |
| **Running** | The machine observed the server running. |
| **Dormant** | Declared, but not observed running. |
| **Undeclared** | Observed running, but named in no config file. |

The table is marked "Reconciled against tool calls": **Server**, **Machine**, **Client**, **Transport**, **State**, **Called**, **Last exec**, **Evidence**, **Fleet**. A banner stays above it: "This inventory is incomplete." with "The rows below are what the sensor could read, not necessarily everything that exists."

## Tool Surface

The page refreshes live ("live · 15s refresh") and says what it is built from: "Servers appear here the moment an agent calls one of their tools. Nothing is listed from configuration — this registry is built from observed traffic only."

Tiles: **MCP servers reached** ("discovered from captured tool calls"), **Distinct tools exercised** ("every tool an agent actually invoked"), **Tool calls · window** ("last 24h"), **Sessions using MCP** ("agent sessions that reached a server"), **Blocked calls** ("BLOCK decisions in this window").

**Busiest servers** is "Ranked by observed tool calls · discovered from traffic, not declared in config". The **MCP server registry** lists **Server**, **Tools**, **Calls**, **Decisions**, **Estate** and **Last call**, with "Filter by server or tool…", a time window and **Expand** on each row. From a row, **Write a rule for this server**, **Write a rule for these tools** or **Write a rule for this tool** starts a rule for what you selected; see [Write and publish a rule](https://docs.quintai.dev/policies/write-and-publish-a-rule.md). **view in inventory** opens the same server on **Inventory**. Empty: "No MCP tool calls captured in this window."

## Identity Graph

Three lenses: **Trust** (humans, agents, tools and data), **Lineage** (who started whom) and **All** (every captured relationship). Controls: a time window, "Search the graph…", **Graph** or **Table** mode, an **Undeclared agents** toggle, an inspector and saved views.

Tiles: **Humans attributed**, **Agents indexed**, **Tools reached**, **Credential-grade paths**. The coverage banner qualifies them: totals are "upper bounds, not exact counts", and when "a query hit its row cap — totals are a floor, not exact". Narrow the window before you quote a total.

Empty: "No agents discovered yet." with "Once the sensor observes agent processes on the fleet, the trust surface renders here."

Every member who can see these pages can read them; the only write is the rule started from **Tool Surface**.

## Next

* [Verify and troubleshoot](https://docs.quintai.dev/install/verify-and-troubleshoot.md) when a host is silent or degraded.
* [Sessions, Live Activity and Agents](https://docs.quintai.dev/dashboard/sessions-and-activity.md) for what the agents on those hosts did.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.