> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mission Control and agent runs

> See what changed in production and what your agents did about it. Review the activity feed, filter agent runs, and examine a run from the web app or the CLI.

Findings show the security issues that you have. Mission Control shows the changes in production and the actions of your agents. Mission Control has two views:

* The **Mission Control** activity feed.
* **Agent Runs**, the history of all agent runs.

## Mission Control: the activity feed

![The Mission Control activity feed. A stacked histogram shows events over three days. Below it, a filter panel lists event types such as alert, vulnerability, code change, CI, and resource. The table shows the time, event type, description, agents, and findings for each event.](https://mintcdn.com/tolmo/7vlOnd-Q0dNpaHkM/images/platform/mission-control.png?fit=max\&auto=format\&n=7vlOnd-Q0dNpaHkM\&q=85\&s=9d6158c36d4bb62e4d3613f45544868e)

Mission Control. The histogram shows production events over time. Each row shows one event, the agents that work on it, and its findings.

Mission Control shows events when they occur in your connected environment. An event is a change or an arrival. Examples of events are:

* a new finding or an alert from a connected tool
* a code change or a CI event
* a new or changed compute, datastore, network, identity, or secret resource

Each row shows the agents that work on the event. Each row also shows if the agents are still working on it.

A histogram above the feed shows activity over time. To zoom into a time range, drag across the histogram. To filter the feed, use the event type, the agent, or the finding status. The feed refreshes automatically.

You can also read the feed through the API. See [List activity events](https://docs.tolmo.com/api-reference/activity-feed/list-activity-events.md).

## Agent runs

**Agent Runs** shows all runs of all agents.

![The Agent runs table with the Red Agent filter active, showing run id, agent, trigger, status, result and start time for each run.](https://mintcdn.com/tolmo/kiwEv-e5yPkqiwY3/images/red-team-agent/mission-control-red-runs.png?fit=max\&auto=format\&n=kiwEv-e5yPkqiwY3\&q=85\&s=275405a8fab42a7e2a11638b9fdabb23)

Agent runs, filtered to Red. The filter is part of the link, so you can share the filtered view.

| Column | What it shows |
| - | - |
| **Run** | The ID of the run. The target of the run is below the ID. |
| **Trigger** | The cause of the run: a schedule, an event rule, or a person. |
| **Status** | The state of the run: **Running**, **Completed**, or **Failed**. |
| **Result** | The conclusion of the run. It shows the number of issues that the run reproduced. It also shows if a check did not complete, or if the run reproduced nothing. A completed run can contain a failed check. |
| **Started** | The start time of the run, and its duration. |

You can filter runs by agent: **Red team**, **Blue team**, or **Green team**. You can also filter by status. You can also filter by findings: **Has findings** or **No findings**.

> [!NOTE]
>
> A failed check is a probe that did not complete. It shows a gap in coverage. It is not a vulnerability. The **Result** column shows failed checks, so you can see where coverage stopped.

### Examine a run

Each run has a detail page. The page shows:

* **Run stages**: the current stage of the run in its pipeline. This updates during the run.
* **Endpoint coverage**: the routes that the run tested.
* **Findings**: the names of the findings that the run touched.

A run refers to a finding. It does not copy the finding. An issue can go through Red, Blue, and Green. In that case, it stays one finding with several runs.

### Stop a run

You can stop a run from its detail page. Tolmo then stops the workflow of the run and deletes its sandbox. You cannot undo this. You can stop a run only while its status is **Running**.

## From the CLI

To show recent runs, use these commands:

```bash theme={null}
tolmo red-agent runs --days 7 --run-status completed --json
tolmo blue-agent runs --days 7 --severity high,critical --json
```

Both commands accept these filters:

| Flag | Behavior |
| - | - |
| `--days` | Runs that started in the last N days |
| `--severity` | Comma-separated severities |
| `--run-status` | Comma-separated `running`, `completed`, or `failed` values |
| `--limit` | Page size from `1` to `200`; defaults to `100` |
| `--offset` | Number of matching runs to skip; defaults to `0` |

Each JSON response contains `items` and `total`. To get the next pages, increase `--offset`.

`tolmo blue-agent runs` also accepts two more flags:

* `--scope`: comma-separated target hostnames.
* `--search`: a run ID or a workflow ID.

To examine one Blue run, use this command:

```bash theme={null}
tolmo blue-agent runs show <run-id>
tolmo blue-agent runs show <run-id> --json
```

The identifier can be a scan ID, a `RUN-` prefix, or a workflow ID. The detail view shows the execution stages of the run. A completed run does not mean that the agent confirmed a finding. Always examine the result and the linked [finding](https://docs.tolmo.com/pentesting/findings.md).

To start or schedule Red runs from the CLI, see the [`red-agent` command reference](https://docs.tolmo.com/cli/commands/red-agent).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.