Report · node9 documentation
Report
Period-windowed view of what your AI agents have actually done, spend, blocks, leaks, and what to do about them.
The Report tab is the answer to "what did happen, and what should we do about it?", driven by your post-install audit log plus the forward-only scan rollup. It's window-scoped (24H / 7D / 30D / 90D) and split into five tabs.
The five tabs
OverviewDefault
The headline view: Value Snapshot strip (blocked / found in history / loop waste), 🎯 Action items, period comparison strip, Risk Posture with severity buckets, summary counters, daily activity. Most users live here.
RisksDetail
Per-rule fire counts, top blocked tools, credential-leak patterns, detected scan signals, hour-of-day heatmap, AI agent / machine / MCP server breakdowns.
SessionsDrill-down
Per-session list with prompts, tool traces, cost, and file changes. Filter by signal (DLP, loops, destructive ops, etc.), working directory, or model. Other tabs deep-link here.
FleetMulti-machine
Cross-machine view, which devs' machines have which shields enabled, per-machine blast-radius scores, fleet-wide path exposures.
CostSpend
Full cost breakdown: daily trend, by model, by project. Useful for billing reviews and spotting expensive agent loops.
🎯 Action items panel
Concrete recommendations synthesised from your data
Sits between Value Snapshot and the period-comparison strip on the Overview tab. Turns raw counters into 0–4 concrete next steps you can act on. Four rules in V1:
🔴 Credentials caught: rotate exposed keys when DLP intercepts a credential leak.
🟠 Fleet-wide path exposure: enable
🔵 Block rate elevated: review most-blocked tool when > 1 in 3 calls is being blocked.
🔵 Loop waste: open looping sessions when retry loops have burned more than $1.
Each item has a dismiss button (× icon) that snoozes it for 7 days per workspace via localStorage. When nothing fires, the panel shows a green "All clear" healthy state so you can always confirm the feature is wired.
🔴 Credentials caught: rotate exposed keys when DLP intercepts a credential leak.
🟠 Fleet-wide path exposure: enable
project-jail when sensitive paths are readable on ≥2 machines.🔵 Block rate elevated: review most-blocked tool when > 1 in 3 calls is being blocked.
🔵 Loop waste: open looping sessions when retry loops have burned more than $1.
Each item has a dismiss button (× icon) that snoozes it for 7 days per workspace via localStorage. When nothing fires, the panel shows a green "All clear" healthy state so you can always confirm the feature is wired.
Time range selector
Scoping the window
The
90D matches the
[24H] [7D] [30D] [90D] buttons in the top-right control the period for every panel on every tab. Default is 7D. Switching ranges reloads all data immediately.90D matches the
[N]inety keypress in the terminal monitor's Report view (node9 monitor then press [2]) so the dashboard and the TUI share vocabulary.Agent filter
Per-AI-provider scoping
Visible only when more than one AI provider appears in your data (Claude Code, Gemini CLI, Cursor, etc.). Selecting a specific agent re-queries every panel scoped to that provider. The dropdown stays populated across filter changes so picking "Claude Code" doesn't remove "Gemini CLI" from the options.