> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Activity

> MCP operations and security events in Ultra Hub

**Activity** is the timeline of MCP tool calls and security events. Hub shows synced records from every linked device. The local [`ultra dashboard`](https://docs.ultra.security/observability/dashboard) shows the same page for this device.

Open **Observe → Activity**, or the Activity page in the local dashboard. Search by action, rule, connector, agent, user, or device. **Export** the filtered table as CSV or JSON — see [Exporting table data](https://docs.ultra.security/observability/dashboard.md#exporting-table-data).

The table shows **Action**, **Outcome**, **Connector**, **Agent**, **User**, **Duration**, and **Time**. Each record is its own row. Click a row to open it:

* Tool calls: `/activity/action/<id>`
* Other events: `/activity/event/<id>`

The address bar is the shareable link. **Copy link** copies it. Tool-call pages include request/response JSON, trace ID, errors, identity, device, and **Govern this tool**.

## Filters

| Filter | What it shows |
| - | - |
| **All** | Every record |
| **Actions** | MCP tool calls, resource reads, and prompts |
| **Policy** | Guardrail and governance decisions |
| **Config** | Configuration and drift events |
| **Auth** | Authentication and token refresh |
| **System** | Server lifecycle and connector connect/disconnect |

## Outcomes

| Outcome | Meaning |
| - | - |
| **SUCCESS** | The operation completed |
| **ERROR** | The operation failed |
| **FAILURE** | The operation did not complete. Shown on Config, Auth, and System rows |
| **CANCELED** | The operation was canceled |
| **ALLOW** | Policy permitted the call |
| **BLOCK** | Policy blocked the call |
| **MONITOR** | A guardrail matched silently (visibility only) |
| **REDACT** | A guardrail matched and masked sensitive content |

For pipeline layers, Hub sync, OTLP export, and recorded fields, see [Observability overview](https://docs.ultra.security/observability/overview.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.