Agentic Use records what your coding agents actually did — the shell commands they ran, the MCP tools they called, and the skills they loaded.
What’s on the page
Sub-tabs
The active sub-tab is carried in the URL as?tab=, so a link can open one directly.
The MCP Actions lens is carried too:
?view=unsanctioned opens the Unsanctioned Usage side directly.
A drilled-in server is carried too: ?tab=mcp_tool&server=<server name> opens that server directly, and ?group=<id> opens a group where your organization has servers grouped. Drilling in and returning by the MCP Actions breadcrumb both keep the address in step, so browser back and forward work through a drill-down.
Terminal Run — charts
Terminal Run — table
Searching by trace ID narrows the table to one run.
MCP Actions — MCP Servers
Charts: Top Actions by Server and Top Users. Selecting a bar in either applies it as a filter below.MCP Actions — server detail
Selecting a row opens that server or group on its own. Four figures across the top — Total Logs, Avg Risk Score, High Risk Commands and Active Users — then Top Tools, Top Users and Activity Trend, and a Servers card where the row was a group holding more than one server, for narrowing to one inside it. Below those, the calls themselves:MCP Actions — Audit Logs
A Tool Calls / Audit Logs switch on the server detail opens the raw call history: every MCP call to that server or group with its tool name, the developer who made it and when. Expand a call for the exact arguments sent and the output returned. Where your organization has connected-account signals, an External Domains figure joins the row above, counting the distinct domains this server’s MCP connections are bound to — those outside your whitelist where one is configured, otherwise all of them. Selecting it flips to Audit Logs narrowed to those connections, and the filter shows as a chip you can clear. In the list those calls carry a red marker; expanding one names the account’s domain and how it was classified. The full account is never shown.Audit Logs may not be enabled for your organization. Where it is, it needs Configuration · View with Organization scope - a different area from Agentic Use itself.
MCP Actions — Unsanctioned Usage
With nothing to show, Unsanctioned Usage reads No unsanctioned or unofficial MCP server activity in this period.
Skills
Three figures — Invocations, Skills Used and Users — then three charts: Invocations Over Time (Daily skill invocations), Top Skills (Most invoked in this window) and By Tool (Which agent invoked the skill). The All Skills table carries Skill, Invocations, Users, Tools, Categories, Risk and Last Used, and Search skills, tools, categories filters it. A skill Unbound has not assessed shows as Not scanned. With nothing to show, the charts read No invocations in this window or No tool activity yet, and the table No skill invocations found.Filters and controls
Time range
24 Hours · 3 days · 7 days · 1 month · 3 months · Custom Range Your choice is remembered between visits and applies to charts and table together. A custom range covers any window within the last 90 days; once one is applied, the menu’s Custom Range entry carries a ✓.Filters
Add Filter opens the dimensions available for the current sub-tab. Selections appear as chips and combine.
Unsanctioned Usage drops Risk Levels, Policies and Policy Action, since a blocked call carries none of them. Skills keeps User and adds its own Skill and Tool filters in place of the rest.
Command Families lists the families your agents have run in the last 90 days.
Command families
What you can do
Terminal run panel
Headed with the developer’s name and the run’s timestamp.
View in Logs in the header opens the same activity in Logs. Below Details, Was this analysis helpful? records a helpful or unhelpful mark with optional notes; a role at Analytics · View does not see it.
MCP call panel
Unsanctioned call panel
An Admin also sees MCP Sanction Blocking at the top of the panel. Disable Blocking for This User lets that one developer use unsanctioned and unofficial servers for 24 Hours or 1 Week, after which blocking returns on its own; Cancel brings it back at once.