Agent monitoring with a full audit log of every action
Every action an agent takes is logged with the person, agent, server, and model behind it, from a CRM lookup in Claude to a command on an engineer's laptop. Search the log, replay a session, and export it to your SIEM or stream it via OTLP.
Trusted by
Agent observability
Active users, calls, and success rate per day, per agent, and per server, across every client that connects through the gateway.
Tokens, requests, and estimated cost, broken out by user, session, model, and tool.
Each session replays in order with timestamps, arguments, and results. One click opens who ran a call and what came back.
Export every record to Sentinel, Splunk, or S3, or stream it via OTLP to any collector, so your existing alerting and retention rules apply to agent traffic.
What the log shows
Collected at the gateway
Every call passes through the gateway. The log is complete with nothing installed on a device or added to an agent, and MCP servers nobody approved show up too. See Mint Guard and DLP
Find the cause of an expensive day
Spend ranks by user, session, model, and tool. Open the top session and the log shows what ran: a loop that never exited, an agent re-reading the same long report on every turn, or a batch of image generations.
Measure adoption
Total calls, success rate, and active users over any window, with a weekly timeline and a per-server breakdown of who uses what.
Block risky calls before they run
Destructive actions and reads of secrets are stopped at the gateway. Exports of customer data are flagged in the log. Everything else goes through.
Why a CTO wanted every call logged
Sumesh Suvarna put Bared Footwear on ChatGPT and Claude with access to internal systems. The log is what made that acceptable: every call attributed to a person and searchable, adoption measured, and read or write access set per person at the gateway.
Read the case study“How can you sleep at night knowing your people are using ChatGPT and Claude to reach your internal systems? Not through a UI, not through API keys you manage, but through LLMs. How do you sleep peacefully with that?”
Sumesh Suvarna
CTO, Bared Footwear
Frequently asked questions
Every tool call that passes through the gateway from any AI tool, plus the commands and file edits that coding agents report through hooks. Each record carries the user, agent, server, and model behind it. A session replays in order with each call's arguments and result.
No. Calls that go through the gateway are logged there, with nothing added to the agent or the machine. That covers Claude, ChatGPT, Copilot, and any other MCP client. For coding agents that run tools locally, hooks for Claude Code and Cursor report that activity into the same log.
Clients authenticate through your identity provider before they reach a server, so each request carries the user's identity. An agent acting for someone carries both the user and the agent, and sessions are searchable by either.
Yes. Risky calls are screened inline: a destructive command or a read of .env or SSH keys is blocked before it executes, and everything else goes through. Run the policy in monitor-only mode first to see what it would have blocked.
Start logging agent activity today
Connect an agent and see its first call in the log. Coursera put 2,000 employees and hundreds of MCP connections behind the gateway.