Skip to main content
Agent Telemetry shows your security team how developers use AI coding agents. Hooks on developers’ machines collect tool calls, MCP usage, shell commands, skill invocations, and session lifecycle events for Tool Call Analytics, the Agent Timeline, and Agent Sessions.
Agent Telemetry is part of Agent Governance and is available on the Enterprise plan. Corridor collects events from Cursor, Claude Code, OpenAI Codex, Devin Desktop, and Factory Droid through Hooks. Event coverage varies by agent; Cursor and Claude Code provide the fullest event streams today.

​
What’s collected

Corridor classifies each agent lifecycle event by type: Dashboards display fields such as tool names, commands, and file paths.

​
Tool Call Analytics

Governance → Analytics shows aggregate agent tool-call activity across your team, including MCP, shell, skill, and built-in tool activity.
  • Tool calls over time: a time-series chart with totals, a period from 1 hour to 90 days, an adjustable bucket size, and breakdowns by MCP server, tool, shell command, platform, or event kind
  • MCP Servers: tool-call totals for each server
  • Top Tools and Top Bash Commands: breakdown tables that identify the agent platform each entry predominantly came from
The data refreshes about once a minute while the page is open.

​
Agent Timeline

Governance → Timeline shows a searchable, row-level stream of agent events across your team. A volume histogram can group events by platform or event type, and you can drag over it to zoom into a time range. The page has three tabs:
  • Events lists individual events. You can filter by text, time period, event type (included or excluded), platform, and shell command. Select a row to see event details, including the parsed shell command and event payload. Recent time windows update every few seconds.
  • Sessions lists each agent session with its start time, duration, developer, platform, and activity mix across shell, MCP, tool, skill, and prompt events. Select a session to open its trace.
  • Shell Usage focuses on shell commands and uses advisory risk badges to highlight sensitive or destructive commands. Shell Command Controls can block these commands before they run.

​
Agent Sessions

Governance → Agent Sessions is available to team Owners and Admins. It shows coding-agent conversations across your team, with a searchable session list on the left and the selected session’s transcript on the right. The transcript presents each session as a sequence of prompts and agent actions, including shell commands, MCP or tool calls, and skill invocations.

​
How collection works

  1. A developer installs the Corridor CLI or IDE extension, which registers Corridor’s hooks with the coding agent.
  2. The hooks send lifecycle events to Corridor as the agent works.
  3. Corridor uses the authenticated token to resolve the user, team, and project on the server. It does not trust identity asserted by the client.
  4. The events become available in your team’s telemetry and the three dashboard views.
Telemetry covers only machines where Corridor’s hooks are installed and enabled. Corridor cannot observe an agent from the server alone.

​
Enabling and disabling

Agent Telemetry requires the Enterprise plan. Your team controls collection:
  • In Team Settings → Agent Observability, the Agent Telemetry toggle controls collection for the whole team. Only team Owners can change it.
  • Turning the toggle off makes the server drop incoming events immediately. Connected clients stop sending events shortly afterward.
  • Tool Call Analytics, the Agent Timeline, and Agent Sessions are visible to team Owners and Admins.

​
Next steps

Shell Command Controls

Block shell commands before they run