Report · node9 documentation
Report
Period-windowed view of what your AI agents have actually done — spend, blocks, leaks, and what to do about them.
The Report tab is the answer to "what did happen, and what should we do about it?" — driven by your post-install audit log plus the forward-only scan rollup. It's window-scoped (24H / 7D / 30D / 90D) and split into five tabs.
The five tabs
OverviewDefault
The headline view: Value Snapshot strip (blocked / found in history / loop waste), 🎯 Action items, period comparison strip, Risk Posture with severity buckets, summary counters, daily activity. Most users live here.
RisksDetail
Per-rule fire counts, top blocked tools, credential-leak patterns, detected scan signals, hour-of-day heatmap, AI agent / machine / MCP server breakdowns.
SessionsDrill-down
Per-session list with prompts, tool traces, cost, and file changes. Filter by signal (DLP, loops, destructive ops, etc.), working directory, or model. Other tabs deep-link here.
FleetMulti-machine
Cross-machine view — which devs' machines have which shields enabled, per-machine blast-radius scores, fleet-wide path exposures.
CostSpend
Full cost breakdown: daily trend, by model, by project. Useful for billing reviews and spotting expensive agent loops.
🎯 Action items panel
Concrete recommendations synthesised from your data
Sits between Value Snapshot and the period-comparison strip on the Overview tab. Turns raw counters into 0–4 concrete next steps you can act on. Four rules in V1:
🔴 Credentials caught — rotate exposed keys when DLP intercepts a credential leak.
🟠 Fleet-wide path exposure — enable
🔵 Block rate elevated — review most-blocked tool when > 1 in 3 calls is being blocked.
🔵 Loop waste — open looping sessions when retry loops have burned more than $1.
Each item has a dismiss button (× icon) that snoozes it for 7 days per workspace via localStorage. When nothing fires, the panel shows a green "All clear" healthy state so you can always confirm the feature is wired.
🔴 Credentials caught — rotate exposed keys when DLP intercepts a credential leak.
🟠 Fleet-wide path exposure — enable
project-jail when sensitive paths are readable on ≥2 machines.🔵 Block rate elevated — review most-blocked tool when > 1 in 3 calls is being blocked.
🔵 Loop waste — open looping sessions when retry loops have burned more than $1.
Each item has a dismiss button (× icon) that snoozes it for 7 days per workspace via localStorage. When nothing fires, the panel shows a green "All clear" healthy state so you can always confirm the feature is wired.
Time range selector
Scoping the window
The
90D matches the
[24H] [7D] [30D] [90D] buttons in the top-right control the period for every panel on every tab. Default is 7D. Switching ranges reloads all data immediately.90D matches the
[N]inety keypress in the terminal monitor's Report view (node9 monitor then press [2]) so the dashboard and the TUI share vocabulary.Agent filter
Per-AI-provider scoping
Visible only when more than one AI provider appears in your data (Claude Code, Gemini CLI, Cursor, etc.). Selecting a specific agent re-queries every panel scoped to that provider. The dropdown stays populated across filter changes so picking "Claude Code" doesn't remove "Gemini CLI" from the options.