Analytics

The Analytics dashboard visualizes tool usage trends, performance metrics, and user activity across your MCP integrations. Use it for aggregate trends over a time window; for individual events, use Logs. Open it from Monitor > Analytics.

Date range and filters

• Start Date and End Date set the reporting window. Every metric and chart on the page reflects this range.
• Advanced Filters narrows the dashboard by user and AI agent. Overview also supports MCP server and grouping filters; Skills & Commands adds a specific skill or command filter.
• The refresh button at the top right reloads the data.

Each stat card shows the change versus the previous period of the same length.

Enable more data sources

Willow gateway activity appears automatically. Add one or more sources for the other Analytics tabs:

• Claude Code OpenTelemetry (Claude Code): enable OpenTelemetry in Admin > Settings > Beta Features, open Monitor > Claude Code, add the telemetry add-on to a policy, then export and deploy the policy. It sends OTLP metrics and events: active time, cost, tokens, commits, pull requests, and native skill events. Content capture for prompts, responses, tool details, and tool output is optional.
• Claude Cowork OpenTelemetry (Cowork): Cowork does not consume Claude Code policies. Open Monitor > Analytics > Data sources, then copy the endpoint, http/json protocol, and authentication header into Anthropic Admin settings > Cowork > Observability. It sends OTLP events including messages, model responses, tool usage, API requests, and errors. Save and start a new Cowork session. Cowork monitoring requires an Anthropic Team or Enterprise plan.
• Codex OpenTelemetry (Codex): Codex does not consume Claude Code policies. Open Monitor > Analytics > Data sources, expand the Codex card's Configure Codex manually, and copy the [otel] block (the org token is already baked in). It sends OTLP logs, metrics, and traces. Deploy it one of three ways:
  • Single machine: paste the block into ~/.codex/config.toml and restart Codex.
  • Team or organization (managed settings): distribute the same block as Codex managed settings — a managed_config.toml pushed via macOS MDM (the com.openai.codex domain, key config_toml_base64), or written to /etc/codex/managed_config.toml (Linux/macOS) or %ProgramData%\OpenAI\Codex\ (Windows). Managed defaults apply at launch and take precedence over the user's ~/.codex/config.toml. Because users can override managed defaults mid-session, add a matching hook in the admin-enforced requirements.toml if you need telemetry to stay on.
  • Automatically: let the Willow Scan Agent configure it for you (see below).
• Willow Guard Hooks plugin (Claude Code, Cursor, and Codex): open Security > Guards > Setup > Guard Hooks, activate the plugin, choose its hooks, and deploy it through managed settings or your plugin marketplace. Hook events capture messages, user-invoked skills and commands, MCP prompts, and guard decisions. See Guard Hooks.
• Willow Scan Agent (Claude Code, Codex, and Cursor telemetry): deploy the agent to discover installed AI agents, MCP servers, skills, and commands on managed devices and automatically configure telemetry. For Claude Code and Codex it writes the native OTLP exporter config; Cursor has no native OTLP export, so the agent installs a Cursor lifecycle hook that buffers events locally and uploads them to Willow in batches (no per-event network call). Toggle each agent under Admin > Settings > Log Settings > Collect Agent Telemetry. See Deploy the Scan Agent.

For local Claude Code testing, use Install for me when exporting a policy. For fleet deployment, use MDM or managed settings.

Summary metrics

Four cards summarize the selected range:

Metric	Description
Tool Calls	Total number of tool calls made through the gateway.
Active Users	Distinct users who made at least one call.
Success Rate	Share of tool calls that completed successfully.
Avg Calls/User	Average number of tool calls per active user.

Usage Over Time

The Usage Over Time chart plots activity across the selected range on a dual axis: Tool Calls as bars (left axis) and Active Users as a line (right axis), so you can see volume and reach together. Use it to spot spikes, drops, and adoption trends.

Below it, two donut charts break the same activity down by MCP Servers and by AI Agent, showing each one's share of total usage (for example, Everything MCP 83% and Context7 17%, or Cursor 100%).

Breakdown tables

The lower half of the dashboard holds detailed tables and charts. Each table has its own Export CSV action.

Section	Type	Columns
Top MCP Servers	Table · Export CSV	Integration, # Tool Calls, # Users, Success Rate, Avg Time
Top AI Agents	Table · Export CSV	Client, # Tool Calls, # Users, Success Rate
Average Response Time	Line chart	Average tool response time (ms) plotted across the range
Top Errors	Table · Export CSV	Integration, Tool, # Errors, Error Rate, and a View action to inspect each error. Shows "No data available" when there are no errors
Top Users	Table · Export CSV	User, # Tool Calls, Success Rate

Export data

Select Export CSV on any table to download that breakdown for offline analysis or reporting.

What to do next

• Logs: drill from an aggregate trend into the individual events behind it
• Investigate with Logs: diagnose a spike or a drop in success rate
• Radar: review flagged security and operations gaps
• Dashboard: the at-a-glance overview of your organization