Dashboard

Real-time security operations center for AI agent activity

Dashboard

The Quint Dashboard is a Vite + React single-page application (TanStack Router) that serves as the operator interface for CISOs and security engineers. It provides real-time visibility into every AI agent action across your fleet, with risk scoring overlays, org-wide alerting configuration, and compliance reporting. (Policy authoring is not built — see Policies.)

Dual Mode Architecture

The dashboard runs in two modes, sharing the same codebase but connecting to different backends:

	Local Mode	Cloud Mode
URL	http://localhost:8080	https://cloud.quintai.dev
Hosting	Embedded in the Go daemon (quint watch)	Vercel (multi-tenant)
Auth	None (localhost only)	httpOnly session cookie from the platform API (email code / Google / WorkOS)
Data source	Go proxy REST API on :8080	quint-platform API on AWS
Scope	Single machine	Entire fleet
Use case	Developer workstation monitoring	Organization-wide SOC

Local mode automatically strips HTTP_PROXY and HTTPS_PROXY environment variables to prevent a proxy loop where the dashboard’s own requests get intercepted by the daemon.

Data Flow

The dashboard never communicates directly with daemons running on enrolled machines. All data flows through the API service:

In local mode, the diagram simplifies to a single daemon serving both the dashboard static files and the API endpoints on localhost:8080.

Key Views

Event Feed

Real-time stream of every agent action intercepted by Quint proxies across the fleet. Each event displays the action classification (domain:scope:verb), risk score (1-100), verdict (allow/flag/block), and originating agent.

Filters include:

• Agent — filter by specific agent identity or word-based name
• Platform — filter by AI platform (Cursor, Claude Code, Copilot, etc.)
• Risk level — critical, high, medium, low
• Time range — last hour, 24 hours, 7 days, or custom range
• Verdict — allow, flag, block

Fleet Overview

Displays all enrolled machines with daemon health status, agent count per machine, and protection tier. Each machine card shows:

• Daemon version and uptime
• Active agent count and types
• Last event timestamp
• Protection mode (relay, gateway, or forward proxy)

Agent Graph

Interactive parent-child visualization of agent spawn trees, powered by XYFlow. Each node represents an agent with its confidence score and detection method. Edges show spawn relationships with timestamps.

The graph helps operators trace delegation chains, such as when a Cursor agent spawns a sub-agent that calls a different model provider, which in turn invokes MCP tools.

Policy sync (delivery only)

The dashboard does not have a policy editor. Policy authoring is not built.

What exists today is the delivery lane: each endpoint polls GET /v1/machines/{id}/policies on its heartbeat and applies whatever it receives. That endpoint is live, ETag-gated, and serves an empty rule set for every organization — so no rule reaches any endpoint, and nothing is enforced. Enforcement runs in shadow mode fleet-wide by decision; see Shadow enforcement.

Policy authoring, historical preview, and dry-run are planned and not shipped. They were described here before they existed; that was wrong and this section is the correction.

Compliance Reports

Per-framework violation summaries (SOC 2, ISO 27001, NIST, GDPR, PCI DSS) with:

• Time-scoped filtering (daily, weekly, monthly)
• Violation counts grouped by framework control
• Trend charts showing compliance posture over time
• Exportable reports (PDF, CSV)

Alerting rules

The Policies view shows the org-wide alerting rules and delivery configuration the alert-processor actually enforces — read-only. There is no per-alert acknowledge/escalate/dismiss workflow.

Audit Trail

Searchable audit log. Entries are Ed25519-signed and SHA-256 chain-linked to their predecessors, so an edit to signed history is cryptographically detectable. Two honest caveats a reviewer will hit: rows written before signing was enabled on an installation predate the chain, and chain verification runs over a bounded window (quint audit verify --window), not the entire history in one call. Operators can:

• Search by agent, action, time range, or verdict
• Verify chain integrity over a chosen window
• Export audit logs for external compliance tools

Tech Stack

This table previously listed a Next.js 16 / Server Components / Supabase-auth stack that matches nothing in the repository. The actual stack, from package.json on main:

Technology	Purpose
Vite + React	SPA build and rendering
TanStack Router	File-based routes (src/routes/)
TanStack Query	Server-state fetching and caching
Tailwind	Styling
XYFlow	Agent spawn graph visualization

Authentication

1. Cloud Mode

   The platform API issues the session as an httpOnly cookie (email login code, Google, or WorkOS). The dashboard’s /api/auth proxy forwards it with credentials: "same-origin"; client code deliberately cannot read the session, and there is no token in the bundle — the design recovers from a previously-published VITE_-prefixed key.

2. Local Mode

   No authentication. The dashboard is served on localhost:8080 only and is not accessible from outside the machine. This is appropriate for single-developer workstation monitoring.

Route Structure

This section previously showed a Next.js app/ tree that did not match the repository (and labelled policies/ a “Policy editor” — no editor exists). The actual routes, from src/routes/ on main:

src/routes/
  index.tsx         Overview
  activity.tsx      Event feed
  agents/           Agent list and details
  anomalies.tsx     Behavioral anomalies
  ask.tsx           Redirect stub to /sentinel (Ask was renamed)
  audit.tsx         Audit trail viewer
  behavior.tsx      Behavioral analytics
  compliance.tsx    Compliance views
  data.tsx          Data sources (telemetry capture layers, per host)
  identity.tsx      Agent identity
  incidents/        Incidents
  integrations.tsx  Integrations
  keys.tsx          API token management
  policies.tsx      Org alerting rules and delivery (read-only — NOT a policy editor)
  runtimes.tsx      Runtime inventory
  sentinel.tsx      Sentinel — natural-language Q&A over fleet data
  sessions/         Session explorer
  settings.tsx      Organization settings
  shadow.tsx        Shadow-mode findings (scope violations)
  team.tsx          Team member management
  tools.tsx         Tool inventory