> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard

> Real-time security operations center for AI agent activity

# Dashboard

The Quint Dashboard is a Vite + React single-page application (TanStack Router) that serves as the operator interface for CISOs and security engineers. It provides real-time visibility into every AI agent action across your fleet, with risk scoring overlays, org-wide alerting configuration, and compliance reporting. (Policy authoring is not built — see [Policies](/api/policies).)

## Dual Mode Architecture

The dashboard runs in two modes, sharing the same codebase but connecting to different backends:

|                 | Local Mode                                | Cloud Mode                                                                   |
| --------------- | ----------------------------------------- | ---------------------------------------------------------------------------- |
| **URL**         | `http://localhost:8080`                   | `https://cloud.quintai.dev`                                                  |
| **Hosting**     | Embedded in the Go daemon (`quint watch`) | Vercel (multi-tenant)                                                        |
| **Auth**        | None (localhost only)                     | httpOnly session cookie from the platform API (email code / Google / WorkOS) |
| **Data source** | Go proxy REST API on `:8080`              | quint-platform API on AWS                                                    |
| **Scope**       | Single machine                            | Entire fleet                                                                 |
| **Use case**    | Developer workstation monitoring          | Organization-wide SOC                                                        |

<Note>
  Local mode automatically strips `HTTP_PROXY` and `HTTPS_PROXY` environment variables to prevent a proxy loop where the dashboard's own requests get intercepted by the daemon.
</Note>

## Data Flow

The dashboard never communicates directly with daemons running on enrolled machines. All data flows through the API service:

```mermaid theme={null}
flowchart LR
    subgraph Machines["Enrolled Machines"]
        D1["Daemon 1"]
        D2["Daemon 2"]
        D3["Daemon N"]
    end

    subgraph Cloud["Cloud Infrastructure (AWS)"]
        API["quint-platform API\n(ECS)"]
        PG["PostgreSQL\n(RDS)"]
        Supa["Supabase\n(Auth only)"]
    end

    subgraph Dashboard["Dashboard (Vercel)"]
        UI["Next.js App"]
    end

    D1 -->|push events| API
    D2 -->|push events| API
    D3 -->|push events| API
    API --> PG
    UI -->|REST queries| API
    UI -->|auth session| Supa
```

In local mode, the diagram simplifies to a single daemon serving both the dashboard static files and the API endpoints on `localhost:8080`.

## Key Views

### Event Feed

Real-time stream of every agent action intercepted by Quint proxies across the fleet. Each event displays the action classification (`domain:scope:verb`), risk score (1-100), verdict (allow/flag/block), and originating agent.

Filters include:

* **Agent** — filter by specific agent identity or word-based name
* **Platform** — filter by AI platform (Cursor, Claude Code, Copilot, etc.)
* **Risk level** — critical, high, medium, low
* **Time range** — last hour, 24 hours, 7 days, or custom range
* **Verdict** — allow, flag, block

### Fleet Overview

Displays all enrolled machines with daemon health status, agent count per machine, and protection tier. Each machine card shows:

* Daemon version and uptime
* Active agent count and types
* Last event timestamp
* Protection mode (relay, gateway, or forward proxy)

### Agent Graph

Interactive parent-child visualization of agent spawn trees, powered by **XYFlow**. Each node represents an agent with its confidence score and detection method. Edges show spawn relationships with timestamps.

The graph helps operators trace delegation chains, such as when a Cursor agent spawns a sub-agent that calls a different model provider, which in turn invokes MCP tools.

### Policy sync (delivery only)

The dashboard does **not** have a policy editor. Policy authoring is not built.

What exists today is the delivery lane: each endpoint polls
`GET /v1/machines/{id}/policies` on its heartbeat and applies whatever it
receives. That endpoint is live, ETag-gated, and serves an **empty rule set for
every organization** — so no rule reaches any endpoint, and nothing is enforced.
Enforcement runs in shadow mode fleet-wide by decision; see
[Shadow enforcement](/dashboard/shadow-enforcement).

Policy authoring, historical preview, and dry-run are **planned and not
shipped.** They were described here before they existed; that was wrong and this
section is the correction.

### Compliance Reports

Per-framework violation summaries (SOC 2, ISO 27001, NIST, GDPR, PCI DSS) with:

* Time-scoped filtering (daily, weekly, monthly)
* Violation counts grouped by framework control
* Trend charts showing compliance posture over time
* Exportable reports (PDF, CSV)

### Alerting rules

The Policies view shows the org-wide alerting rules and delivery configuration the alert-processor actually enforces — read-only. There is no per-alert acknowledge/escalate/dismiss workflow.

### Audit Trail

Searchable audit log. Entries are Ed25519-signed and SHA-256 chain-linked to their predecessors, so an edit to signed history is cryptographically detectable. Two honest caveats a reviewer will hit: rows written before signing was enabled on an installation predate the chain, and chain verification runs over a bounded window (`quint audit verify --window`), not the entire history in one call. Operators can:

* Search by agent, action, time range, or verdict
* Verify chain integrity over a chosen window
* Export audit logs for external compliance tools

## Tech Stack

This table previously listed a Next.js 16 / Server Components / Supabase-auth
stack that matches nothing in the repository. The actual stack, from
`package.json` on `main`:

| Technology          | Purpose                           |
| ------------------- | --------------------------------- |
| **Vite + React**    | SPA build and rendering           |
| **TanStack Router** | File-based routes (`src/routes/`) |
| **TanStack Query**  | Server-state fetching and caching |
| **Tailwind**        | Styling                           |
| **XYFlow**          | Agent spawn graph visualization   |

## Authentication

<Steps>
  <Step title="Cloud Mode">
    The platform API issues the session as an **httpOnly cookie** (email login
    code, Google, or WorkOS). The dashboard's `/api/auth` proxy forwards it with
    `credentials: "same-origin"`; client code deliberately cannot read the
    session, and there is no token in the bundle — the design recovers from a
    previously-published `VITE_`-prefixed key.
  </Step>

  <Step title="Local Mode">
    No authentication. The dashboard is served on `localhost:8080` only and is not accessible from outside the machine. This is appropriate for single-developer workstation monitoring.
  </Step>
</Steps>

## Route Structure

This section previously showed a Next.js `app/` tree that did not match the
repository (and labelled `policies/` a "Policy editor" — no editor exists).
The actual routes, from `src/routes/` on `main`:

```
src/routes/
  index.tsx         Overview
  activity.tsx      Event feed
  agents/           Agent list and details
  anomalies.tsx     Behavioral anomalies
  ask.tsx           Redirect stub to /sentinel (Ask was renamed)
  audit.tsx         Audit trail viewer
  behavior.tsx      Behavioral analytics
  compliance.tsx    Compliance views
  data.tsx          Data sources (telemetry capture layers, per host)
  identity.tsx      Agent identity
  incidents/        Incidents
  integrations.tsx  Integrations
  keys.tsx          API token management
  policies.tsx      Org alerting rules and delivery (read-only — NOT a policy editor)
  runtimes.tsx      Runtime inventory
  sentinel.tsx      Sentinel — natural-language Q&A over fleet data
  sessions/         Session explorer
  settings.tsx      Organization settings
  shadow.tsx        Shadow-mode findings (scope violations)
  team.tsx          Team member management
  tools.tsx         Tool inventory
```