Skip to content
10

Observe

Analytics

What agents exist, who owns them, what they touch, how often they are refused, which models and tools they consume, and what it costs. The inventory is built from observed traffic, not from a spreadsheet someone maintains.

The problem

Most organisations cannot name every agent already running inside them. Agents arrive through IDE extensions and side projects, and the first accurate inventory usually arrives with an incident.

Capabilities

How Analytics works

  • 01

    Inventory from traffic

    Agents are discovered by their calls. Ownership gaps are surfaced as a work queue rather than assumed to be complete.

  • 02

    Refusal analytics

    A rising deny rate on one tool is either an attack, a broken agent, or a policy that is too tight. The distinction is visible here and it is the most useful signal the system produces.

  • 03

    Cost and consumption

    Model spend, token volume, and tool call counts attributed per agent, per team, and per environment.

  • 04

    Runtime health

    Latency at each stage of the decision path, hold queue depth, approval turnaround, and policy evaluation time.

In practice

What it looks like

Deny rate by tool, last 7 days
tool                     calls    denied   rate    Δ 7d─────────────────────────────────────────────────────────fs.read                 41,208       312   0.8%    +0.1http.request            12,884       410   3.2%    +2.7  ▲db.query                 8,410        22   0.3%    −0.1k8s.apply                  184        61  33.2%    +0.4slack.post               6,022         3   0.0%     0.0 ▲ http.request denials rose 2.7 points. 88% originate from  one agent (agt_2M7T4A) after a tool-result injection flag.  Open incident  ·  Inspect runs  ·  Simulate policy change

Limits

What this does not do

Stated plainly, because a control plane that claims no limits has either not been deployed or is not being described accurately.
  • Inventory covers agents whose calls traverse Cirvix. Discovering the ones that do not is what `cirvix scan` is for, and that gap is reported rather than hidden.
  • Cost figures are derived from provider pricing and observed token counts. They are an attribution model, close but not a substitute for your provider invoice.

Get started

Let the agents do real work.

Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.

Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.