Admin dashboards

Know at a glance whether your org is safe, healthy and getting value from its agents. The admin dashboards bring adoption, cost, network traffic, credentials and cluster capacity together in one place. Org owners and admins open them with Dashboards in the sidebar. For the pull requests your agents deliver, see Pull request impact. Other members do not see the item.

What you can do with it

Run the Monday review from one page. Open Overview to see what Marshal delivers, who is adopting it, how deputies are doing, what it costs, where traffic was blocked and whether provisioning is healthy. Every figure opens the dashboard it came from.
Answer the security team. Open Security Center to show where agent traffic went, what was blocked, and which credentials have not been rotated. Hand over Export Compliance CSV from Operations as evidence.
Plan the next team’s onboarding. Open Servers to see how much CPU and memory is committed before you invite twenty more people.

See it end to end: A governed dev environment for every engineer.

The questions each tab answers

Is everything healthy right now?

Overview is the first page of Dashboards. It is organized in six sections, and each section has an Open link to its main dashboard in the corner. Select any figure or chart to open the dashboard it came from.

Impact: Marshal share of merged PRs and Marshal PRs merged for the last 4 weeks, each compared with the 4 weeks before, and a chart of merged pull requests per week over 12 weeks, Marshal against everyone else. Opens Impact.
Adoption: Active devs (7d), Sessions (7d), Active this week out of all members, Licensed users, and a chart of active users per day over 30 days. Opens People.
Deputies: Deputy runs (7d) with their success rate, Child runs started (7d), and a chart of deputy runs per day over 30 days. Opens Deputies.
Spend: Est. spend (30d), Est. LLM cost (30d), Est. infrastructure (monthly), and a chart of LLM cost per day over 30 days. Opens Costs.
Security: Blocked egress (7d), Sessions on allow-all, Active package blocks, Running spaces affected by a block, and a chart of blocked egress per day over 30 days. Opens Security Center.
Health: Active spaces now, Provision success rate (7d) with a warning under 95%, CPU and memory committed, Long-running spaces, and a chart of provision latency per day over 28 days. Opens Operations.

Where a figure has a comparison, it shows the change against the period before. Long-running spaces counts the spaces that have run longer than your long-running threshold, and selecting it opens Sessions with only those spaces. The figure is hidden when the threshold is 0. When your cluster has no compute rate set, Est. spend (30d) shows Space-hours (30d) instead.

Each section loads on its own. If one source is slow or unavailable, that figure names what is missing and offers Retry, and the rest of the page keeps working. The impact figures note when repos are still syncing. The live figures refresh every 30 seconds and the rest every 5 minutes.

Operations goes deeper: how many spaces exist, the provision success rate, spaces in error, spaces stuck for more than 10 minutes in a changing state, provision latency, an error breakdown, and the savings from stopping and resuming spaces.

What is running, and who owns it?

The Sessions tab lists every space of every member, live and stopped. Filter by state, by member, or search by name, slug or person. Columns include the owner, state, size, agent, network profile, credentials, LLM and Compute cost, running time, stop reason and last activity. Select a row for details, including the space’s compute cost next to its LLM total. If you start a stopped space whose size now moves its workspace off a persistent disk, a message tells you the owner needs to choose.

Three columns tell you how recently a space was used. Last activity is the latest sign of life from the space and decides when auto-stop fires. User active is the last time a person did something: typed in the terminal, sent a run prompt, or stopped or resumed the space. Last connected is the last time a terminal or CLI connection was open to the space. Background traffic from an agent moves Last activity only, so User active and Last connected show when a person was really there. A space nobody has touched shows a dash in both. The details panel lists the same two times.

Select Long-running to list only the spaces that have run longer than the threshold. Their running time shows in amber in any view, so you can see who to ask and stop what was left on. Set the threshold with Long-Running Space Threshold (days) in Settings > Configuration, Spaces group. See Spaces and storage.

Spaces that run an older manifest than the one they were made from show a Runs an older manifest label in the space list. They pick up the current manifest the next time they are resumed unless Refresh Spaces On Resume is set to never. See Spaces and storage.

The row menu can Start, Stop, Archive or Delete any space. Delete asks you to confirm.

Are we safe?

To block a vulnerable package version, see Security Center. Network traffic and credentials are the Egress and Credentials tabs of the same Security Center page:

Top Egress Destinations (7d) and Egress Decision Breakdown: where space traffic goes, and what was allowed or blocked.
Network Posture: how many spaces ran with deny-all, allow-all or a custom profile. See Network policy.
Credential Governance: how many credentials were used in the last 7 days, sit idle or were never used, how many are overdue for rotation, and Exfiltration attempts (7d): requests Marshal blocked because they carried an HTTP secret placeholder to a host the secret is not for. Select the number to open every attempt with its time, member, space, secret and destination. Filter by type, space or user, select a row for details, and download the list with Export CSV. Secret values never appear.
Credential Inventory: every credential with its owner, scope, last use and status. It counts idle, never-used and stale credentials. Revoke on a row deletes that credential at once, after you confirm, and every space that uses it loses access.
Blocked Egress Anomalies (30d) and Active Alerts: unusual blocked traffic.
Live Audit Stream: events as they happen. See Audit log.

Export Compliance CSV on Operations downloads a report for the last 90 days: denied and blocked traffic by day and host, your network policy mix, and the count of stale credentials.

What does this cost?

Open Costs to see LLM and compute spend on one page. The top shows the last 30 days: Total, LLM, Compute and Compute share, a daily chart, and one sentence with your real split, such as “Compute was 6% of your spend in the last 30 days.” Compute covers CPU, memory and disk, and splits into what your spaces used and what sat idle.

The LLM tab shows token spend for the last 7, 30 or 90 days, for everyone or one person, with a per-person table of LLM, Compute and Total. Prices come from Settings > LLM Cost.
The Compute tab shows what the cluster costs per month, every space disk and what happens to it next, the prices behind every figure, and Compute by user (30d).

See Costs.

Compute cost also sits next to LLM cost on Sessions, Orchestration, Deputies, and the Costs tab of every space and run. Every member sees their own LLM and compute cost, and their own impact, under My usage in the account menu.

Who is adopting?

People shows member, active-now, weekly adoption and 30-day launch totals, then a table of every member with their role, spaces active now, total spaces, 30-day launches and last activity. Filter by role, search by name or email, sort by any column, and show 25, 50 or 100 rows per page. Select a person to see their spaces. To change members, go to Settings > Members.
Usage shows the last 28 days of adoption and utilization: an AI intensity score per person, spaces and active people per day, the mix of agents, compute utilization, egress, and MCP and tool usage. Spend has its own page, Costs.

How are deputies doing?

Open Deputies to see whether your org is adopting deputies and whether they work. Org owners and admins see the tab. Other members do not, and cannot read its data. Choose 7 days, 30 days or 90 days at the top. Every number compares with the period of the same length just before it, and the page refreshes every 2 minutes.

The tiles sit at the top:

Active deputies, with how many are suspended
Runs
Success rate
People: members who created a deputy or started a run
Hours waiting: time runs spent on people
Cost per successful run

Top deputies ranks your deputies by runs. Each row shows the owner, a daily trend, how many people started runs, the success rate, the median (p50) and 95th percentile (p95) duration, cost and the last run. Select a name to open the deputy. A Flagged badge marks a deputy with a mission that often needs extra help. Hover over it to see which mission and why.

Runs per day, by trigger stacks each day’s runs by what started them: manual, schedule, webhook, api or mcp. Runs started from an MCP client, such as Claude or your editor, count as mcp. Runs that an agent launches through Marshal’s tools from inside a space count as api.

Adoption shows:

Deputies by state and Deputies by owner level (org, team or personal)
New deputies per week
People and missions: how many members use deputies, out of all members, plus active missions and missions per active deputy
Dormant deputies, each with its owner and when it last ran

Trigger inventory lists your enabled schedules and your enabled webhook bindings by integration and event.

Reliability shows:

Success and failure: succeeded, failed, timed out and in flight, the most common failure reasons, and canceled runs counted apart from the rate
Timeout extensions: how many chains were extended, how much time was added, and how many timed out even after an extension
Continuations: manual, park and resume, and wake, by kind and by depth
Launch queue: median wait, and launches refused, expired or dropped
Webhook funnel: events received, and how many launched a run or failed
Failing schedules: each schedule whose latest attempt failed, with its deputy, mission, cron expression and error

Human in the loop shows Engagements by kind (FYI, Approve, Ask, Review and Takeover) with how many were answered, expired, canceled or still open. Time to answer gives the median on Web, Slack and CLI and counts failed Slack deliveries. Takeovers shows how often people took over a run and extended their access window.

Cost shows run hours, compute, LLM and total cost for the org and for each deputy, with token totals. LLM cost and Compute cost take you to the matching tab of Costs. Your agent can read the same figures by deputy, by day or both with the admin_cost tool. See Connecting an AI agent (MCP).

How the numbers are counted

A run is a chain. A run plus every time it was continued, by hand, after a park or on a wake, counts once. A run that parked twice and then succeeded is one success.
Success rate is succeeded divided by succeeded, failed and timed out. Canceled chains and chains still in flight are left out of the rate. A chain belongs to the period its first run started in.
Dormant means an active deputy that is at least 14 days old and has had no run in the last 14 days. A new deputy that has not run yet is not dormant.
Flagged means a mission where at least 25% of its chains had a timeout extension, or at least 25% had a manual continuation, across at least 4 chains in the period.
Hours waiting adds the time runs spent waiting for an answer, working with a person at the wheel, or parked, plus time a person paused a run’s timeout.
Cost is compute plus LLM cost. Compute is the CPU, memory and disk of the deputy’s run spaces over the days they ran, at the same prices as Costs. LLM prices and token counts match the LLM tab of Costs. Usage on a model with no price is marked unpriced and never counted as $0. Cost per successful run is that total divided by successful chains.
Webhook, refusal and access-window counts reach back as far as your org keeps its event history. When that is shorter than the period you chose, the panel says how far back its data goes.

An org with no deputies sees what the page will show, with Create a deputy. An org too large for a long period shows a message that suggests a shorter one.

Each deputy has its own view of these measures. See Insights.

What are we licensed for?

Licensing shows the licensed users for the month, your deputies’ daily peak against the concurrency limit, and the days launches waited. It also holds Request more capacity, Refresh license now and Reported to Marshal. See Licensing and What your install reports to Marshal.

Do we have room?

Servers groups the cluster’s nodes into a Control plane card and a Spaces card. Each card sums up CPU and memory requested, ready nodes, and pods or spaces, and the Spaces card splits by node group when your spaces run on more than one. Expand a card to see each node with CPU and memory committed against capacity, node disk, pods and the spaces on it. Each space row shows its owner, compute class and Uptime, with its CPU, memory and disk requests. Only your org’s spaces are listed. Select Refresh for a new reading. For planning, see Sizing.

Configure it

These settings are under Settings > Configuration, in the Admin group. Org owners and admins can change them.

Setting	Default	Range	What it controls
Hourly Rate (cents)	20	0 to 10000	The cost of one space hour, used for compute cost only when your cluster has no prices at all. `0` also hides amounts on members’ My usage page, which then shows tokens only.
Credential Rotation Period (days)	90	0 to 3650	Credentials older than this count as stale in Credential Inventory. `0` turns the check off.
Blocked Egress Alert Threshold	0 (off)	0 to 1,000,000	Raises an alert when blocked requests in one day reach this number. See Alerts.

Edge cases

The dashboards cover your org only.
Archived and deleted spaces are not listed on the Sessions tab.
Cost figures are estimates. Compute cost uses your cluster’s billed, custom or list prices, and LLM cost uses list prices.

Try it

Open Dashboards, then Security Center, choose the Egress tab, and look at Top Egress Destinations (7d) to see where your agents’ traffic went this week.