Observability
MCP Console
loading…

### Edit rule

### Sign in

Username
Password

# Overview

Live
Data Sources
-
configured
Sources Up
-
connected
Services
-
discovered
Services Healthy
-
live
MCP Endpoint: http://localhost:3000/mcp

## How it works

◇Agent MCP call
⛨Gate entitlement · RBAC · catalog
⇄Connectors Prometheus · Loki
✦Analysis scored health

## Today's MCP usage

Loading…

## Sources

Loading...

## Services

Loading...

## Needs attention

—
Loading…

## Services by health score

Loading…

# Data Sources

## All sources

Loading...

# Services

## Discovered services

Loading...

# Connectors

## Installed connectors

Loading...

## Available from the Connector Hub

Open Hub ↗
Loading...

## Upload a connector bundle

Install a signed connector `.tgz` directly — handy for air-gapped environments. The bundle is always verified against the configured trust root before it is loaded.

# Service Health

Loading health data...

# Infrastructure Topology

## Sources & counts

Loading topology...

## Grouped by host (pivots on the `RUNS_ON` relation)

Scope filter
Scope = any resource pointed to by an `IN_NAMESPACE` edge (e.g. k8s namespaces, future: vCenter folders).
Loading...

## Layered graph

click a resource to inspect · drag to reposition · wheel to zoom · drag the background to pan
Tab to focus · Enter to inspect · arrows to move focus · Esc to clear
Select a resource on the left to inspect its labels, attributes and neighbours.

# Inspect — agent activity

Whether a call is normal vs. the learned baseline for that identity — behavioral guardrails. Distinct from Policies (allowed at all).
… Window

## Flows identities → tools → backends · edge width = call volume · colour = allowed / deviation / blocked

Tab to focus · Enter to inspect · arrows to move focus · Esc to clear
Loading flows…
Select a node or edge on the left to inspect its calls, argument shapes and posture.
Mode
…

## Behavior profile learn a baseline from observed traffic, then accept the rules that look right

### Review queue

No suggestions yet. Click Learn from traffic to derive rules from what agents have actually done.

### Accepted rules

No accepted rules yet. Accept suggestions above to build the enforceable profile.

### Rejected rules

No rejected rules. Rejected suggestions are kept here (not deleted) and won't reappear in the review queue on re-learn — restore one anytime.

## Deviations calls outside the accepted profile — would-block in dry-run, blocked in enforce

Switch to Dry-run and accept some rules — calls that fall outside them show up here as “would-block”, so you can verify the profile before enforcing.

# Settings

Check Interval (ms)
How often the agent scans for anomalies
Default Sensitivity

Configure how service health scores are calculated. Weights must sum to 1.0.

### Weights

Error Rate
Latency
CPU
Log Errors

### Thresholds

#### CPU (%)

Good ≤
Warn ≤
Crit ≤

#### Error Rate (req/s)

Good ≤
Warn ≤
Crit ≤

#### Latency P99 (seconds)

Good ≤
Warn ≤
Crit ≤

#### Log Errors (/min)

Good ≤
Warn ≤
Crit ≤

### Status Boundaries

Healthy above score
Degraded above score

Each data source has its own metric definitions with backend-specific queries (PromQL, LogQL, etc.). Use `{{service}}` as placeholder for the service/job name.

Source:

Name | Unit | Query | Description |
--- | --- | --- | --- | ---
Select a source above

# Access Control

Who can sign in and which role they hold — identities, SSO/OIDC, sessions. Authentication.

## How governance fits together

Access Control who you are→ Products what you're offered→ Policies what you're allowed→ Inspect is it normal
Each layer answers a different question. Catalog runs alongside, adding resource context (owners, criticality). Audit Log records every change. Policies = allowed at all (static); Inspect = normal vs. the learned baseline (behavioral).

## Roles & bindings

Loading…
Use Edit policy above — no command line needed. The block below is the optional API equivalent for automation/CI.
▾API · add a role & binding via curl

    # grant the "viewer" role read-only metrics, bind a principal to it.
    # needs an admin API key (a principal the current policy grants admin).
    curl -X PUT http://localhost:3000/api/enterprise/policy \
      -H "Authorization: Bearer <ADMIN_API_KEY>" \
      -H "Content-Type: application/json" \
      -d '{
        "roles": {
          "viewer": { "tools": ["query_metrics","get_service_health"], "readOnly": true }
        },
        "bindings": { "alice": ["viewer"] }
      }'

Edit roles & bindings below — no JSON required. JSON / YAML are optional alternative views. Saving needs an admin API key.

# Postmortems

## Generated reports

Loading…

## Report

# Tool Playground

## Invoke a tool

Tool
Arguments (JSON)
{}

## Result

# Context Products

Curated, governed tool bundles you expose to an agent or credential.

Which tools a credential is offered (packaging). Distinct from Policies, which decide what's permitted.

## MCP Products

Loading…
Bind a credential to a product

Bind a credential to a product via `OMCP_KEY_PRODUCTS`; the agent's next `/mcp` session then sees only that product's tools:

    OMCP_API_KEYS="agent:tok_ops,ci:tok_dev"
    OMCP_KEY_PRODUCTS="agent=ops-bundle;ci=dev-bundle"

Full docs →

Legacy catalog (enterprise)

Deprecated. Backed by `OMCP_ENTERPRISE_CATALOG_FILE`. Use MCP Products above for new deployments.

Loading…
Define products & grants below — no JSON required. JSON / YAML are optional alternative views. Saving needs an admin API key.
▾API · create a context product via curl

    # publish a "payments-eu" product and grant it to a principal.
    # needs an admin API key (a principal the current policy grants admin).
    curl -X PUT http://localhost:3000/api/enterprise/catalog \
      -H "Authorization: Bearer <ADMIN_API_KEY>" \
      -H "Content-Type: application/json" \
      -d '{
        "products": {
          "payments-eu": {
            "description": "EU payment-service metrics + logs",
            "sources": ["prometheus","loki"],
            "services": ["payment-service"]
          }
        },
        "grants": { "alice": ["payments-eu"] }
      }'

# Policies

What a role is allowed to call at all — coarse RBAC (resource × action). Distinct from Inspect, which judges whether a call is normal.
Engine tenant-aware

### Probe a permission

Roles comma-separated
Resource
Action
Tenant optional

## Roles

Loading…
Select a role on the left to see its permission matrix.

## Bindings

Loading…

### New role

Role name
Pattern: `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`. New roles append to the policy file; existing names overwrite.
Permissions
Tick cells to grant. Empty rows mean the role has no access to that resource.

### Edit binding ·

Select the roles to grant . Unknown roles are rejected — the catalogue comes from the active engine.

Loading…

## Subjects

Loading…

## Provisioning

Loading…

## Batch evaluate

Subjects (one role per line; format: `label=role1,role2`; e.g. `alice=viewer`):
Resources (multi-select):
Actions (multi-select):
Pick subjects + resources + actions, then click Evaluate.

## Active policy (legacy view)

# Audit Log

An append-only, tamper-evident record of every mutating action — who did what, when.

## Recent decisions

Loading…

## Management changes

Loading…

# Entitlement

Read-only

## Access-control gate

Loading…
▾CLI · mint a token · API · check the gate

    # issuer side — sign an entitlement token
    node enterprise/entitlement/mint.mjs \
      --key issuer-ed25519.pem \
      --sub org-acme --features access-control,audit --ttl 365d

    # deployment — current gate mode
    curl -s http://localhost:3000/api/enterprise/status

### Add Source

Name
Unique identifier
Type
URL
Authentication
Username
Password
Token
Skip TLS Verify Accept any certificate (insecure)
CA Certificate Path
Custom CA for self-signed certs (safer than skip verify)
Client Certificate Path
For mutual TLS (mTLS)
Client Key Path
Tenant (optional, admin-only)
Tagged source is visible only inside its tenant. Blank = global (every tenant). Non-admins can only see / create within their own tenant.
Enabled

### Delete

Are you sure you want to delete ?

### Add Metric

Name
Friendly name used in MCP tool calls
Query
Backend-specific query. Use {{service}} as the service/job placeholder.
Unit
Description

### New Product

Give the product a stable id (URL-safe, immutable once saved) and a display name agents will see in `tools/list`.

Id
Pattern: `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`. Immutable once saved.
Display name
Description (optional)

Curate the tools an agent bound to this product can call. Leaving everything unchecked = no filter (every registered tool).

Loading…

Pick the lifecycle stage, the tenant scope, optional version, and the branding metadata that surfaces on the catalogue card.

Status
Tenant (admin only)
Blank = same tenant as the calling user.
Version (optional)
Brand colour (optional)
Icon URL (optional)

Confirm everything below, then save. Staging products are admin-only; published products are visible to agents in the selected tenant.

### Agent preview

This is the `tools/list` set a credential bound to this product would receive on its `/mcp` session.

### Detail