GET
/api/v1/agents?status=all&limit=500
⎘ copy
⟳ 10s
ALL
ACTIVE
IDLE
OFFLINE
DEAD
⚠ REP
VIEW
A2A Conversations — delegation edges from live flow data
⬡
No A2A conversations yet
Run an A2A test — edges appear after flows age through Weaver (~90s cold-start)
● Agent
Host
Protocols
Flows/s
Rep
Actions
GET
/api/v1/counters
⎘ copy
⟳ 10s
↻
↺ Reset All
POST
/mcp/v1/ → tools/call: maya/skills/list
⎘ copy
↻
GET
/api/v1/policy
⎘ copy
↻
+ New Rule
BUILDER
RAW JSON
✕
RULE NAME * — required for flow-end rules; optional for BPF fast-path
PRIORITY
MATCH
conditions OR'd within a group · groups AND'd · Raw JSON for arbitrary nesting
ACTION
VERDICT
ALERT ON MATCH
COUNTER (optional)
⚡BPF fast path — enforced at first packet
BPF FAST-PATH RULE
→ POST /api/v1/policy · enforced at first packet
Fields:
type (agent|prefix|flow) · said/cidr · action (drop|mirror|fwd)
FLOW-END BEHAVIORAL RULE
→ POST /api/v1/policy/llm · evaluated after each flow closes
Fields:
name · priority · match (MatchExpr) · action {verdict, alert, counter, shadow}
🧠 FLOW-END BEHAVIORAL RULES
0 rules
🧠
No flow-end behavioral rules configured
Click + New Rule and add LLM signal or multi-condition rules
GET
/api/v1/mcp/servers · /api/v1/egress/budget
⎘ copy
↻
⟳ 10s
South→north egress, per agent, by destination and volume — payload-blind by design.
Token figures are estimates (~bytes÷4, model unknown); the only $ is your own converter.
Est. Tokens (total) ±
—
Agents Over Budget
—
Providers In Use
—
Contradicting Declared
—
Egress Token Budget
runaway detector, not billing · session-accumulated (persisted rollups: fast-follow) · Burl watches, fires an event on breach — does not block
Filter by provider:
Agent
Destination
Provider (by dest)
Conns
↑ Bytes
↓ Bytes
Est. tokens in/out ±
Budget
Declared?
🛰
No AI egress observed yet.South→north egress, per agent, by destination and volume — payload-blind by design.
Agent × Server Call Matrix
⬡
No topology data
GET
/api/v1/threats
⎘ copy
↻
⟳ 10s
Total Detected
—
Mitigated
—
Pending
—
Critical
—
Warnings
—
ALL
⬤ CRITICAL
⬤ WARN
⬤ INFO
Bulk:
⏱ Auto-expire: info 2h · warn 24h · critical never
⊛ Dedup: 5m window
⊠ Suppressed: 0
THREAT LIFECYCLE CONFIG
Age
Rule
Severity
Agent
Server
Signal
Actions
🛡
No threats detected.Threats are auto-detected from MCP/LLM flow telemetry.
GET
/api/v1/threats
· class=baseline_deviation
↻
⟳ 15s
Sus
Agent
Why — monitor assessment
Age
Actions
🔎
No baseline deviations.Burl flags first-seen behavioral deviations here as they're observed.
GET
/api/v1/system
⎘ copy
↻
◈
Loading…
📤 OTLP Export
—
🛑 Burl assessments
—
pauses LLM calls only · baseline preserved · cap 20/min always on
Live Logs
idle
loom
weaver
fatty
burl
|
⎘
⤓
🗑
📤 OTLP EXPORT
—
Tier 0
—
dropped: —
📤 OTLP EXPORT
Send telemetry to an OTLP collector (Datadog, Splunk, Grafana, …)
Collector endpoint (host:port)
Transport security
Client cert (PEM path)
Client key (PEM path)
CA cert (PEM path)
Bearer token
Egress interface for export
· export traffic is bound to this interface
—
⚠ No dedicated egress interface available — export cannot be enabled on this host.
Add a second network interface dedicated to management/export traffic.
Export verbosity tier
Inventory counts only · no PII · no content
Connection metadata · who-to-whom · no payload
LLM signals + MCP detail · per-subject · audited
⚠ Configure destination first
Warp ID (stamped on all signals)
Export interval
Effective: —
· instance-id or persisted UUID · never hostname
select a dedicated egress interface to enable export
export_dropped: —
📤
Configure an OTLP export destination above to begin sending telemetry.Tier 0 (default): aggregate counts only — no per-agent detail, no PII.
Tier 0
·
— agents
·
per-agent subjects: 0
(ephemeral — cleared on page reload)
dropped: —
Per-agent export subjects
Agents with 📤 Export active · activate from the Agents tab row
No per-agent export subjects active. Use the 📤 Export button on any agent row to add one.
Escalation audit log
tier changes · destination changes
Loading…
🎯 FLOW HUNT
Narrow criteria to preview matching flows, then ▶ Start Hunt to install a rule.
Host ↳ src filter
Source Agent · blank = any
✎ raw sAID
Dst Agent · A2A hunt
✎ raw dAID
Dst CIDR · blank = any
Dst Port · blank = any
Protocol
Auto-expire · seconds
No criteria = match all flows from any agent
Matching flows from recent flow history — snapshot only, not live.
Flows that ended before you started hunting are visible here but not in the live event feed.
ACTIVE HUNTS
· max 16 concurrent
No active sessions — set criteria and ▶ Start Hunt above
Connected — waiting for flows matching criteria
AgentDestinationProtoSeenActions
🔒 LOCKED FLOWS
· rules active in data plane
RuleTargetAgentLockedUndo