Skip to main content
Explore lists every agent session and its tool calls.

​
Find a session

Choose a time range in the top right. Explore defaults to the last 24 hours. The Active sessions over time chart shows active session counts across that range. Drag across the chart to narrow the range. Select Clear focus to restore it. Use Search sessions to narrow the table. The table has these columns: Select Open in Explore in an endpoint’s drawer on Home to search Explore for that endpoint.

​
Read the tool calls

Expand a session to see its tool calls with Decision, Mode, Tool, Summary, Risk and Time. Turn on Flagged only to show calls a risk detector flagged. Select Load more to fetch the remaining calls. The decision records what the policy decided. The mode shows how the endpoint applied it. The Risk column is advisory. A flag never changes the decision. See Risk.

​
Open a tool call

Select a tool call to open its drawer. Press j and k to step to the next and previous call. The drawer summarizes the decision and mode in one sentence. It then shows the reason, time and duration: If the call failed, the sentence ends with “the call ran and failed.” If a person interrupted it, the sentence ends with “the call was interrupted by the user.” For an enforced Deny, the reason reads “Blocked by rule” followed by the rule ID. The drawer has these tabs:
  • Verdict shows the request, what the agent said it was doing, the execution evidence and the result.
  • Risk shows detector results from Kestrel, Merlin and the Additional shell check under Detection details. The tab appears when detector details exist for the call. It also offers Kestrel feedback when Kestrel scored the call. Open the drawer from Risk to see the AI assessment or use Explain with AI.
  • Input and Output show the captured tool input and output. A Secrets redacted tag means Kontext removed credentials before storage. The Payload capture mode in data collection controls what you see. Earlier calls retain the data captured under their original setting. Summaries keeps redacted parameter summaries. Omitted records payload sizes. Enabling Full payloads does not recover earlier inputs or outputs.
  • Context shows who the call acted for, the agent’s permission mode, the agent, the working directory, the endpoint, and the session.
The agent’s permission mode is separate from Kontext’s mode. Kontext enforces policies even when the agent uses bypass mode.

​
When something is missing

Explore shows activity shortly after it happens on the endpoint. A tool call may lack a result while its session runs. If you cannot find a session, check the time range, then see troubleshooting.