> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard

> Web-based monitoring dashboard

Ultra includes a built-in web dashboard for monitoring MCP traffic, inspecting traces, and viewing audit logs.

## Starting the Dashboard

```bash theme={null}
ultra dashboard
```

This starts a web server at `http://localhost:8080` and reads data from Ultra's local storage.

## Flags

| Flag        | Short | Default                    | Description                      |
| ----------- | ----- | -------------------------- | -------------------------------- |
| `--address` | `-a`  | `:8080`                    | Listen address for the dashboard |
| `--storage` | `-s`  | `~/.config/ultra/ultra.db` | Path to the local storage file   |
| `--dev`     |       | `false`                    | Enable development tools         |

## Examples

```bash theme={null}
# Default — port 8080
ultra dashboard

# Custom port
ultra dashboard --address :9090

# Custom storage path
ultra dashboard --storage /path/to/ultra.db
```

## Dashboard Features

### Traffic Overview

Real-time view of **recent** MCP operations flowing through Ultra:

* Request count, success/error rates
* Per-server breakdown
* Latency distribution

### Trace Inspector

Drill into individual operations:

* Full request/response payloads
* Duration and status
* Upstream server and tool name
* OpenTelemetry trace and span IDs

### Audit Log Viewer

Browse security audit events:

* Filter by event type, severity, and outcome
* View details for each event
* Track who did what and when

## Exporting table data

Most data tables in the dashboard carry an **Export** control in the toolbar. It's available on Traffic, Audit, Servers, Tools, and Clients in both the Hub dashboard and the local `ultra dashboard`, plus Gateways, Identities, Anomaly scans, and the Admin Log, which are Hub-only surfaces.

Click **Export** and choose **CSV** or **JSON**:

* **The full result set, not just the page you're looking at.** Whatever filters, search, and sorting are applied carry into the file, and every matching row is included across pagination, up to a cap of 50,000 rows. Past that cap the export stops and a notice asks you to narrow the filters to pull the rest.
* **Only the visible columns are exported.** Action and UI-only columns are skipped, and internal fields that some rows carry (raw request/response payloads, workspace and organization IDs) are never written to the file.
* **CSV** is UTF-8 with a byte-order mark so spreadsheet apps render names and emails correctly, uses RFC 4180 line endings, and hardens against spreadsheet formula injection. **JSON** preserves native types (numbers stay numbers, booleans stay booleans) for programmatic use.
* Files are named `<surface>-<timestamp>`, for example `audit-20260601-214233.csv`.

### Exporting a selection

Tables with a checkbox column let you export a subset instead of the whole result set. Tick individual rows, or use the header checkbox to select every row on the current page, then choose **Export** to download only those rows. The toolbar shows the selected count with a **Clear** control. Selection is scoped to the page you're viewing and resets when you change filters, sorting, or page. On some pages, a selection also enables bulk actions next to **Export**.

## Sharing links

Detail views in the dashboard are deep-linkable, so you can point a teammate straight at a specific record. Open any detail drawer or detail page and use the **Copy link** button (the link icon in the drawer header) to copy a URL that reopens that exact item.

| Surface   | Link opens                            |
| --------- | ------------------------------------- |
| Traffic   | A specific trace (`?trace=`)          |
| Audit     | A specific audit event (`?event=`)    |
| Clients   | A specific client (`/clients/<name>`) |
| Gateways  | A specific gateway (`?gateway=`)      |
| Anomalies | A specific finding (`?finding=`)      |

Opening a shared link loads the page and automatically opens the matching drawer. If the target no longer exists (for example, a gateway that has since been removed), the dashboard shows a "not found" notice instead of opening an empty drawer.

## Storage

The dashboard reads from the same local storage that Ultra writes to during operation:

```
~/.config/ultra/ultra.db
```

You can run the dashboard while Ultra is running — concurrent reads and writes are supported.

<Tip>
  Run `ultra start` in one terminal and `ultra dashboard` in another to monitor traffic in real time.
</Tip>