Filters and the four tiles

Activity is a live feed — it refreshes every ten seconds, and the pulsing dot beside the title means what you are looking at is current.

The tiles

Over the selected window: Requests, Blocked, Top models (top three) and Top MCP servers (top three). Each shows "No data yet" rather than a zero when there is genuinely nothing, so you can tell "quiet" from "broken".

Top MCP servers is the one people find most surprising. It is a ranking of what your AI assistants are actually reaching for.

The filters

• Time window — last 24 hours, 7 days or 30 days.
• Outcome — all, OK, blocked, or upstream error.
• Event type — all, requests, or risk events.
• Developer — a specific person. The list includes admins as well as developers, because admins can have governed tools too.
• Model — free text, so opus narrows to everything with that in the model name.

Combinations worth knowing

• Blocked, last 7 days — the review you should do weekly. It tells you whether your policy is doing something useful or just being annoying.
• Risk events, last 30 days — what the detectors are finding, independently of whether anything was stopped.
• One developer, 24 hours — what you look at when somebody says "it stopped working".

The four tiles and the filter row. "No data yet" rather than a zero, so quiet reads differently from broken.