Analytics

unbound analytics tool-use reads the Analytics → Tool Use tables from the terminal: what agents ran, which MCP tools they called, and which policies matched. Requires Admin or Analytics Viewer role. Run unbound status to check.

Datasets

Dataset	What it holds
`terminal`	Terminal commands agents ran, with risk score and matched tool policies
`mcp-actions`	Individual MCP tool calls, with server, tool, targets and risk score
`unsanctioned`	MCP calls to servers your organization has not sanctioned (blocked or warned)
`mcp-servers`	One row per MCP server: action count and average risk

unbound analytics tool-use terminal
unbound analytics tool-use mcp-actions --server claude_ai_notion
unbound analytics tool-use unsanctioned --time-window THIRTY_DAYS
unbound analytics tool-use mcp-servers

Run mcp-servers first when you need a value for --server — it lists the names the other datasets accept.

Filters

All of these take comma-separated values and work on every dataset unless noted.

Flag	Filters by
`--time-window <w>`	`ONE_DAY`, `THREE_DAYS`, `SEVEN_DAYS`, `FOURTEEN_DAYS`, `THIRTY_DAYS`, `THREE_MONTHS`. Default `THIRTY_DAYS`
`--start`, `--end`	A custom range as `YYYY-MM-DD`, up to 90 days. Not combined with `--time-window`
`--tool <types>`	AI tool, e.g. `CLAUDE_CODE,CURSOR,CODEX`
`--user <ids>`	User IDs (see `unbound users list`)
`--risk <levels>`	`Low`, `Medium`, `High`
`--policy <ids>`	Tool policy IDs (see `unbound policy tool list`)
`--family <families>`	Command family — `terminal` only
`--server <names>`	MCP server or service name — MCP datasets only
`--initiator <who>`	`user`, `agent`, or `unknown` — `terminal` and `mcp-actions` only; the other datasets reject it with `unknown option`

unbound analytics tool-use terminal --risk High --time-window SEVEN_DAYS
unbound analytics tool-use terminal --family git_action,delete_file --initiator agent
unbound analytics tool-use terminal --start 2026-07-01 --end 2026-07-31

Output

The default is a table sized to your terminal, showing a curated set of columns.

Flag	Behavior
`--format <f>`	`table` (default), `json`, or `csv`
`--json`	Shorthand for `--format json`
`--wide`	Print full values instead of clipping to the terminal width
`--limit <n>`	Rows to show — default 20, max 100 for a table and 1,000 for JSON. Over the cap the command exits 1 rather than clamping
`--offset <n>`	Skip n rows, for paging
`-o, --output <file>`	Write to a file instead of stdout. Requires `--format json` or `--format csv` — with the default table it exits 1 with `-o needs --format json or --format csv`

Use --wide, or --format json, to see the columns the table hides.

Use --format csv for everything, rather than paging a table.

Paging

Each page prints where it sits in the result set:

ℹ Showing 1-20 of 548. Page with --offset 20, or use --format csv to export every row.

Paging stops at an offset of 25,000 — past that the request is rejected with Offset cannot exceed 25000. Use format=csv to export everything. A result set deeper than that is a job for --format csv, which returns every row in one file.

For scripts and agents

--format json is a stable contract:

{
  "dataset": "terminal-runs",
  "columns": ["Timestamp", "User", "..."],
  "rows": [["2026-08-05T09:55:44Z", "..."]],
  "total_count": 1431,
  "returned_count": 20,
  "offset": 0,
  "next_offset": 20,
  "has_more": true
}

Every cell is a string, and rows align to columns. Page with --offset next_offset until has_more is false — use the next_offset you were given rather than working one out, or pages will overlap. Diagnostics go to stderr and stdout carries only the payload, so it is safe to pipe. The exit code is 0 on success and 1 on any error.

unbound analytics tool-use terminal --format json --limit 100 \
  | jq -r '.rows[] | @tsv'
unbound analytics tool-use terminal --format json \
  | jq -r '(.columns, .rows[]) | @csv'

Exporting

--format csv exports every matching row rather than one page. The file is prepared in the background and the command waits for it — see Exports for how that works, and for exporting Logs, Tasks and Users the same way.

unbound analytics tool-use terminal --start 2026-07-01 --end 2026-07-31 \
  --format csv -o july-terminal-runs.csv

Requires CLI 1.15.0 or later.

Getting Started

CLI

Policies

Hooks API

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Analytics

Datasets

Filters

Output

Paging

For scripts and agents

Exporting

​Datasets

​Filters

​Output

​Paging

​For scripts and agents

​Exporting

Datasets

Filters

Output

Paging

For scripts and agents

Exporting