> ## Documentation Index > Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt > Use this file to discover all available pages before exploring further. # Analytics — Agentic Use > Shell commands, MCP tool calls and skills your agents ran, with every chart, column and filter | | | | ----------- | ---------------------------------- | | **URL** | `/analytics/agentic-use` | | **Sidebar** | Analytics → Agentic Use | | **Roles** | Admin · Manager · Analytics Viewer | Agentic Use records what your coding agents actually did — the shell commands they ran, the MCP tools they called, and the skills they loaded. ## What's on the page ### Sub-tabs The active sub-tab is carried in the URL as `?tab=`, so a link can open one directly. | Sub-tab | `?tab=` | Shows | | ---------------- | -------------- | ------------------------------------------------------------------ | | **Terminal Run** | `terminal_run` | Shell commands agents executed | | **MCP Actions** | `mcp_tool` | MCP tool calls, under an **MCP Servers / Unsanctioned Usage** lens | | **Skills** | `skills` | Skills agents loaded · Admin · Beta · gated — contact support | The MCP Actions lens is carried too: `?view=unsanctioned` opens the Unsanctioned Usage side directly. A drilled-in server is carried too: `?tab=mcp_tool&server=` opens that server directly, and `?group=` opens a group where your organization has servers grouped. Drilling in and returning by the **MCP Actions** breadcrumb both keep the address in step, so browser back and forward work through a drill-down. ### Terminal Run — charts | Chart | Grouped by | Empty state | | ------------------------- | --------------- | ---------------------------------- | | **Terminal Command Runs** | Command family | *No risky terminal commands found* | | **Top Risky Users** | User | *No risky users found* | | **Matched Tool Policies** | Matching policy | *No matched tool policies found* | ### Terminal Run — table | Column | Contents | | ------------------ | --------------------------------------------------- | | **Timestamp** | When the command ran | | **User** | The developer it ran as | | **Command Family** | The classified family, such as *Read File* | | **Risk Score** | A score with a severity icon · sortable | | **Initiator** | Whether the developer or the agent chose the action | | **Policy Match** | The policies this run matched | **Initiator** shows one of four states: | Badge | Meaning | | ------------------ | -------------------------------------------------------------------- | | **User Requested** | The developer asked for this directly | | **Agent Decided** | The agent chose it while working | | **Unknown** | Attribution was not determined for this run | | **Processing** | *Analysis in progress* — the badge settles once attribution is known | ### MCP Actions — MCP Servers Charts: **Top Actions by Server** and **Top Users**. Selecting a bar in either applies it as a filter below. | Column | Contents | | -------------- | ------------------------------------------------------------------------------------------------------------- | | **Server** | The MCP server. Where your organization has servers grouped, a row is the group and how many servers it holds | | **Logs Count** | Calls recorded · sortable | | **Risk Score** | Its score · sortable | ### MCP Actions — server detail Selecting a row opens that server or group on its own. Four figures across the top — **Total Logs**, **Avg Risk Score**, **High Risk Commands** and **Active Users** — then **Top Tools**, **Top Users** and **Activity Trend**, and a **Servers** card where the row was a group holding more than one server, for narrowing to one inside it. Below those, the calls themselves: | Column | Contents | | ------------------ | --------------------------------------------------- | | **User** | The developer it ran as | | **Tool Used** | The MCP tool that was called | | **Tool** | The AI tool that called it | | **MCP Name** | The server that served it | | **Matched Policy** | The policies this call matched | | **Risk Score** | Its score · sortable | | **Initiator** | Whether the developer or the agent chose the action | ### MCP Actions — Audit Logs A **Tool Calls / Audit Logs** switch on the server detail opens the raw call history: every MCP call to that server or group with its tool name, the developer who made it and when. Expand a call for the exact **arguments** sent and the **output** returned. Where your organization has connected-account signals, an **External Domains** figure joins the row above, counting the distinct domains this server's MCP connections are bound to — those outside your whitelist where one is configured, otherwise all of them. Selecting it flips to Audit Logs narrowed to those connections, and the filter shows as a chip you can clear. In the list those calls carry a red marker; expanding one names the account's **domain** and how it was classified. The full account is never shown. | Notice | Meaning | | --------------------------- | ----------------------------------------------------------------------------------------------------------- | | *Value truncated at ingest* | The value was too large to keep whole. The note gives the original size in bytes; what you see is a preview | | **Show full** | Values over 4,000 characters are trimmed on screen. Select for the complete value | Audit Logs may not be enabled for your organization. Where it is, it reads to **Admins and Analytics Viewers** — narrower than Agentic Use itself. ### MCP Actions — Unsanctioned Usage | Column | Contents | | -------------- | --------------------------- | | **Timestamp** | When the call happened | | **User** | The developer it ran as | | **MCP Server** | The server that was reached | | **Tool Call** | The call itself | | **Tool** | The AI tool that made it | | **Status** | **Blocked** or **Warned** | ### Skills **Invocations**, **Skills Used** and **Users** for the period, then **Invocations Over Time**, **Top Skills** and **By Tool**. The **All Skills** table carries **Skill**, **Invocations**, **Users**, **Tools**, **Categories**, **Risk** and **Last Used**; a skill Unbound has not assessed shows as **Not scanned**. ## Filters and controls ### Time range **24 Hours · 3 days · 7 days · 1 month · 3 months · Custom Range** Your choice is remembered between visits and applies to charts and table together. A custom range covers any window within the last **90 days**; once one is applied, the menu's **Custom Range** entry carries a **✓**. ### Filters **Add Filter** opens the dimensions available for the current sub-tab. Selections appear as chips and combine. | Filter | Available on | Values | | -------------------- | -------------------------- | --------------------------------------------------- | | **User** | All | The people you can read | | **Tool Type** | Terminal Run · MCP Actions | The AI tools your organization uses | | **Department** | Terminal Run · MCP Actions | Departments in your organization | | **Team Manager** | Terminal Run · MCP Actions | Managers in your organization | | **Risk Levels** | Terminal Run · MCP Actions | Low · Medium · High | | **Initiator** | Terminal Run · MCP Actions | User Intentional · Agent Initiated | | **Policies** | Terminal Run · MCP Actions | Your tool policies | | **Command Families** | Terminal Run | The families your agents have run | | **MCP Servers** | MCP Actions | Servers seen in the range, until you drill into one | Unsanctioned Usage drops Risk Levels, Initiator and Policies, since a blocked call carries none of them. Skills keeps **User** and adds its own **Skill** and **Tool** filters in place of the rest. **Command Families** lists the families your agents have run in the last 90 days. **What a Manager sees here is their own reports.** Admin and Analytics Viewer read the whole organization; a Manager reads themselves and the people who report to them, and the **User** filter lists exactly those people. **Department**, **Team Manager**, **Policies** and **Command Families** do not appear in their **Add Filter** menu, since all four describe the organization rather than a team. ### Command families | Group | Families | | --------------- | ---------------------------------------------------------------------------------- | | System | update system file, environment setup, package management, build operation | | Filesystem | **read file**, write file, delete file | | Process | process management, execute script, update cron | | Network | remote access, data transfer, remote execution | | Container | container operation | | Cloud | cloud read, cloud provision, cloud destroy, cloud IAM, cloud secrets, cloud config | | Security | access password, privilege escalation, environment exposure | | Version control | git action | | Database | database read, database write, database admin | ## What you can do | Action | Result | | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Select a chart label | Applies it as a filter on the table below, adding the matching chip. Select again to clear | | Select a Terminal Run row | Opens the **Terminal run** panel, below | | Select an MCP server row | Opens that server or group's own view | | Select a call on a server's view | Opens the **MCP call** panel, below | | Select an Unsanctioned row | Opens the **Unsanctioned call** panel, below | | Select a skill | Opens the **Skill** panel, below | | Select the first policy in **Policy Match** | Opens the [Policies — Agentic Use](/dashboard/policies/agentic-use) page | | **Tool Calls / Audit Logs** on a server's view | Switches between the classified calls and the raw call history | | **View in Logs** in the Terminal run panel | Opens the [Logs](/dashboard/logs) page at that activity | | Export | CSV of the current filtered view, from **Export Terminal Runs**, **Export MCP Servers**, **Export MCP Actions** and **Export Unsanctioned MCP Usage** · Admin and Analytics Viewer | ### Terminal run panel Headed with the developer's name and the run's timestamp. | Section | Contents | | ------------------- | ------------------------------------------------------------------------------------------- | | **Command** | The exact command, with a copy control | | **Risk Assessment** | **Risk Score** with its icon, **Risk Reason**, and the **AI Analysis** behind the score | | **Details** | **AI tool**, **Classifications**, **Matched Policies**, and the helpful / unhelpful marking | | **User Prompt** | The prompt that led to the command | **View in Logs** in the header opens the same activity in Logs. Marking a run **helpful** or **unhelpful**, with optional notes, tunes future classification. ### MCP call panel | Section | Contents | | ------------------- | --------------------------------------------------------------------------- | | **Risk Assessment** | **Risk Score**, **Risk Reason** and **AI Analysis** | | **Tool Used** | The tool that was called | | **Details** | **MCP Server**, **AI tool**, **Extracted Targets** and **Matched Policies** | | **User Prompt** | The prompt behind the call | ### Unsanctioned call panel | Section | Contents | | --------------- | ---------------------------------------------------------------------------------- | | **Tool Call** | The call that was made | | **Details** | **MCP Server**, **AI tool** and the **Enforcement Message** shown to the developer | | **User Prompt** | The prompt behind the call | ### Skill panel **Invocations**, **Users** and **Tools** for the skill, then **Invocations Over Time**, **By Tool**, **Top Users**, the rendered **Skill Content** — one entry per version where several copies of a skill share a name, with a diff between them — and **Recent Invocations** listing when, who and through which agent. ## Messages you may see | Message | What it means | | -------------------------------------------- | ---------------------------------------------------------------------------------- | | `Failed to load audit logs.` | Audit Logs could not fetch that server's history. Refresh to retry | | `Failed to load skill analytics` | The Skills sub-tab could not load its data | | `Failed to submit feedback` | The mark was not saved. The run is unchanged, so marking again is safe | | `This MCP group or server is not available.` | The server or group in the address is gone or not yours. Return to **MCP Servers** | ## Common questions **How do I find a particular kind of command my agents ran?** **Analytics → Agentic Use → Terminal Run**, then **Add Filter → Command Families** and tick the family — **Read File** for file reads, **Cloud Destroy** for teardown. **Where do I see what files my agents read?** The same route, filtering on **Read File**. Selecting a row shows the exact command and the prompt behind it. **Where do I see MCP tool calls?** The **MCP Actions** sub-tab, under the **MCP Servers** lens. Selecting a server opens its own view; the **Audit Logs** switch there shows every call to it, with the arguments sent and the output returned. **How do I find out which policy stopped something?** The **Policy Match** column names the policies a run matched, and the first links through to the policy. **Why is a command marked as coming from the agent rather than the developer?** The **Initiator** column records who chose the action. **Processing** means attribution is still resolving. ## Related | Page | For | | --------------------------------------------------------- | ------------------------------------------------ | | [Policies — Agentic Use](/dashboard/policies/agentic-use) | Authoring the policies these runs match | | [Logs](/dashboard/logs) | The underlying requests | | [Analytics — Overview](/dashboard/analytics/overview) | The Analytics tabs and the time range they share |