Agent monitoring with a full audit log of every action
Every MCP call, bash command, and file access is logged with the user, agent, server, and model behind it. Search the log, replay a session, and export it to your SIEM or stream it via OTLP.
Trusted by
Agent observability
Active users, calls, and success rate per day, per agent, and per server, across every client that connects through the gateway.
Tokens, requests, and estimated cost, broken out by user, session, model, and tool.
Each session replays in order with timestamps, arguments, and results. One click opens who ran a call and what came back.
Export every record to Sentinel, Splunk, or S3, or stream it via OTLP to any collector, so your existing alerting and retention rules apply to agent traffic.
What the log shows
Collected at the gateway
Every call already passes through the gateway, so the log is complete without installing anything on a device or adding code to an agent. MCP servers nobody approved show up here as well. Mint Guard and DLP are on the security page
Find the cause of an expensive day
Spend ranks by user, session, model, and tool. Open the top session and the log shows what ran: a loop that never exited, a harness sending the whole repo as context, or a batch of image generations.
Measure adoption
Total calls, success rate, and active users over any window, with a weekly timeline and a per-server breakdown of who uses what.
Block risky calls before they run
Destructive commands and reads of sensitive files such as .env and SSH keys are stopped at the gateway and flagged in the log. Everything else goes through.
Why a CTO wanted every call logged
Sumesh Suvarna put Bared Footwear on ChatGPT and Claude with access to internal systems. The log is what made that acceptable: every call attributed to a person and searchable, adoption measured, and read or write access set per person at the gateway. Read the case study
“How can you sleep at night knowing your people are using ChatGPT and Claude to reach your internal systems? Not through a UI, not through API keys you manage, but through LLMs. How do you sleep peacefully with that?”
Sumesh Suvarna
CTO, Bared Footwear
Start logging agent activity today
Connect an agent and see its first call in the log. Coursera put 2,000 employees and hundreds of MCP connections behind the gateway.
Frequently asked questions
Every MCP tool call, bash command, and file access that passes through the gateway, with the user, agent, server, and model behind it. A session replays in order with each call's arguments and result.
No. Calls that go through the gateway are logged there, with nothing added to the agent or the machine. For coding agents that run tools locally, hooks for Claude Code and Cursor report that activity into the same log.
Clients authenticate through your identity provider before they reach a server, so each request carries the user's identity. An agent acting for someone carries both the user and the agent, and sessions are searchable by either.
Yes. Export to Sentinel, Splunk, or an S3 data lake, or stream via OTLP to any collector. Your existing alerting and retention rules apply, and records are immutable.
Both. Spend is broken out by user, session, model, and tool, with agents ranked alongside people, so an expensive day traces to a specific session.
Yes. Risky calls are screened inline: a destructive command or a read of .env or SSH keys is blocked before it executes, and everything else goes through. Run the policy in monitor-only mode first to see what it would have blocked.