Agents

The Agents view gives you visibility into AI agent activity across your organization. It shows how agents interact with Model Context Protocol (MCP) servers, the tools they invoke, the data they transfer, and the users driving those interactions, connecting human and agent identities so you know who did what, and when.

💡

Note: The Agentic Security features are available by request. If you don't see the Agents tab, contact your WitnessAI administrator.

Download this document for prerequisites and instructions:

WitnessAI_AgenticSecurity_How_to_Guide_2026.pdf

2.6 MiB

Prerequisites

The agentic capability must be enabled for your organization. If you don't see the Agents tab, contact your WitnessAI administrator.
At least one agent interaction must have been observed; until then the tab shows an introductory screen with no data.

How it works

As agent traffic passes through WitnessAI, the platform records each agent invocation, the user driving the session, the agent identity, the MCP server connected to, the tools called, and the volume of data transferred. Every invocation is attributed to a corporate identity so agent activity is always accountable to a person. The Agents view aggregates these records so you can explore the agent ecosystem by relationship (Flow Chart), trend action counts over time (Time Series), and drill into individual actions to see what was sent and what came back.

Explore agent activity

Open Discovery and select the Agents tab.
Apply filters (Date Range, Agent, User, Department, Group, or MCP Server) to narrow the metrics and views to the scope you want to investigate.
Toggle between Flow Chart (agent ecosystem) and Time Series (agent actions over time) using the icons in the card header.
Select a department, agent, or server node in the Flow Chart, or select a metric card, to open the detail side panel.
In the side panel, review the tabs (Agents, MCP Servers, Tools, Users, and Actions) to understand the agent's relationships and activity.
On the Actions tab, select an individual action to open Action Details and inspect its Input and Output to see exactly what data the agent sent and received.

Key metrics

The view leads with four metric cards. Select a card to open the matching tab in the detail panel.

Metric	What it counts
Agents	Unique AI agents detected, with a count of newly discovered agents.
MCP Servers	MCP servers accessed by agents, with a count of newly discovered servers.
Tools Used	Tool invocations across all agent activity.
Data Transfer	The volume of data transferred through agent interactions.

Ecosystem views

The main panel offers two views, toggled from the icons in the card header. An expand control enlarges the view.

Flow Chart: An interactive view of the agent ecosystem (titled Agent Ecosystem) with three columns flowing left to right: the leftmost column (labeled Departments by default), Agent Types, and MCP Servers. A toggle on the leftmost column lets you group it by department, user, or group instead. Node size reflects relative usage volume. Select a department, agent type, or server node to drill in; breadcrumbs at the top show your current path, and pagination arrows page through large columns.
Time Series: A chart titled Agent Actions By Type showing how agent activity trends over the selected time range, as stacked bars of action count per agent.

The Agent Ecosystem flow chart with Departments, Agent Types, and MCP Servers columns.

Filters

The filter bar refines the metrics and views. A Clear button appears when one or more filters are active.

Filter	Narrows to
Date Range	The time period to analyze.
Agent	A specific agent.
User	Agents associated with a specific user.
Department	An organizational department.
Group	An organizational group.
MCP Server	Agents accessing one or more specific MCP servers.

Review an agent

Selecting an agent, a node in the ecosystem, or a metric card opens a detail side panel organized into tabs:

Tab	What it shows
Agents	Related agent instances.
MCP Servers	The MCP servers the agent has connected to.
Tools	The tools the agent has invoked.
Users	The users associated with the agent's activity.
Actions	A timeline of the agent's actions, each with a timestamp, the client used, the tool invoked, and a data-transfer badge. Sort by timestamp or by total bytes transferred.

You can drill further from the side panel into focused popovers:

Agent Details: the agent's MCP servers and actions, with a nested conversation view.
Server Details: the server's tools, users, and agents.
Tool Details: the tool's actions, users, and agents.

Inspect an action's input and output

Select an action to open Action Details, which has three tabs:

Tab	What it shows
Overview	The action's context, user, conversation, agent, tool, MCP server, and a data-transfer summary.
Input Data	The data the agent sent to the tool.
Output Data	The data the tool returned to the agent.

The Action Details popover on the Overview tab, showing User, Conversation, Agent, Tool, MCP Server, and Data Transfer.

This input/output drill-down lets you see exactly what an agent sent to a tool and what came back, which is essential when investigating data movement.

Track data transfer

The Data Transfer metric card shows the total volume of data moved through agent interactions for the selected range, along with an up or down percentage change versus the prior period. Each action carries its own data-transfer badge, and the Actions list can be sorted by total bytes so you can find the heaviest transfers quickly.

Agent types

WitnessAI detects and classifies agents across three categories.

Type	Description	Examples
AI app plugin agents	User-facing agentic extensions that run on the client side or in the browser/desktop, communicate directly with model providers, and can reach both remote tools (such as Jira, GitHub, Slack) and local tools on the user's machine.	Claude, Cursor, ChatGPT with plugins
SaaS-embedded AI agents	Agents embedded inside enterprise SaaS platforms that execute tasks through the vendor's internal orchestration, with limited visibility from network inspection.	Microsoft Copilot agents, Salesforce Agentforce
Custom AI agents	Agents built on open-source frameworks and self-hosted on cloud or local infrastructure, which plan autonomously, call APIs, and access enterprise data.	Agents built with LangChain or LlamaIndex

MCP server discovery

WitnessAI also identifies the MCP servers that agents reach:

Remote MCP servers: Publicly accessible servers on the internet that agents connect to for external tools.
Private MCP servers: Servers hosted on your own internal or cloud infrastructure.

For each server, WitnessAI captures details such as name and version, vendor, exposed tools, connection frequency, and identity information. To inspect a server's tools, users, and agents in depth, or to allow or block it, see MCP Servers.

User attribution

Every agent invocation is correlated to a specific corporate identity. WitnessAI maps agent instances to individual users, user accounts to organizational groups, tool access to responsible parties, and data transfers to the users who initiated them, so agent activity is always accountable to a person.

Verify

After opening the Agents view, confirm that the four metric cards (Agents, MCP Servers, Tools Used, Data Transfer) display counts, and that the Flow Chart or Time Series view shows agent activity. If filters are active, check that the metrics reflect the filtered scope by comparing counts before and after clearing filters with the Clear button.

Agents Prerequisites How it works Explore agent activity Key metrics Ecosystem views Filters Review an agent Inspect an action's input and output Track data transfer Agent types MCP server discovery User attribution Verify