> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corridor.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Telemetry & Timeline

> Monitor tool calls, MCP usage, shell commands, skills, and sessions across your team's AI coding agents.

Agent Telemetry shows your security team how developers use AI coding agents. Hooks on developers' machines collect tool calls, MCP usage, shell commands, skill invocations, and session lifecycle events for **Tool Call Analytics**, the **Agent Timeline**, and **Agent Sessions**.

<Note>
  Agent Telemetry is part of [Agent Governance](/agent-governance/overview) and is available on the **Enterprise** plan. Corridor collects events from **Cursor**, **Claude Code**, **OpenAI Codex**, **Devin Desktop**, and **Factory Droid** through Hooks. Event coverage varies by agent; Cursor and Claude Code provide the fullest event streams today.
</Note>

## What's collected

Corridor classifies each agent lifecycle event by type:

| Event type  | What it captures                                       |
| ----------- | ------------------------------------------------------ |
| **Session** | Session start, end, and stop events                    |
| **Prompt**  | A prompt submitted to the agent                        |
| **MCP**     | An MCP tool call, with the server and tool name        |
| **Shell**   | A shell command, split into its commands and arguments |
| **Skill**   | An Agent Skill or slash-command invocation             |
| **Tool**    | A built-in agent tool, such as a file read or edit     |
| **Other**   | An event that does not fit the other categories        |

Dashboards display fields such as tool names, commands, and file paths.

## Tool Call Analytics

**Governance → Analytics** shows aggregate agent tool-call activity across your team, including MCP, shell, skill, and built-in tool activity.

* **Tool calls over time**: a time-series chart with totals, a period from 1 hour to 90 days, an adjustable bucket size, and breakdowns by MCP server, tool, shell command, platform, or event kind
* **MCP Servers**: tool-call totals for each server
* **Top Tools** and **Top Bash Commands**: breakdown tables that identify the agent platform each entry predominantly came from

The data refreshes about once a minute while the page is open.

## Agent Timeline

**Governance → Timeline** shows a searchable, row-level stream of agent events across your team. A volume histogram can group events by platform or event type, and you can drag over it to zoom into a time range.

The page has three tabs:

* **Events** lists individual events. You can filter by text, time period, event type (included or excluded), platform, and shell command. Select a row to see event details, including the parsed shell command and event payload. Recent time windows update every few seconds.
* **Sessions** lists each agent session with its start time, duration, developer, platform, and activity mix across shell, MCP, tool, skill, and prompt events. Select a session to open its trace.
* **Shell Usage** focuses on shell commands and uses advisory risk badges to highlight sensitive or destructive commands. [Shell Command Controls](/agent-governance/shell-command-controls) can block these commands before they run.

## Agent Sessions

**Governance → Agent Sessions** is available to team Owners and Admins. It shows coding-agent conversations across your team, with a searchable session list on the left and the selected session's transcript on the right.

The transcript presents each session as a sequence of prompts and agent actions, including shell commands, MCP or tool calls, and skill invocations.

## How collection works

1. A developer installs the Corridor CLI or IDE extension, which registers Corridor's hooks with the coding agent.
2. The hooks send lifecycle events to Corridor as the agent works.
3. Corridor uses the authenticated token to resolve the user, team, and project on the server. It does not trust identity asserted by the client.
4. The events become available in your team's telemetry and the three dashboard views.

Telemetry covers only machines where Corridor's hooks are installed and enabled. Corridor cannot observe an agent from the server alone.

## Enabling and disabling

Agent Telemetry requires the Enterprise plan. Your team controls collection:

* In **Team Settings → Agent Observability**, the **Agent Telemetry** toggle controls collection for the whole team. Only team **Owners** can change it.
* Turning the toggle off makes the server drop incoming events immediately. Connected clients stop sending events shortly afterward.
* Tool Call Analytics, the Agent Timeline, and Agent Sessions are visible to team **Owners** and **Admins**.

## Next steps

<CardGroup cols={1}>
  <Card title="Shell Command Controls" icon="terminal" href="/agent-governance/shell-command-controls">
    Block shell commands before they run
  </Card>
</CardGroup>