---
title: Activity
description: The live step-by-step feed of what every agent is doing — reasoning, tool calls, results and errors — with a streaming SSE endpoint and per-event drill-down.
keywords: live agent activity, agent reasoning feed, agent tool call stream, real-time agent monitoring
eyebrow: Dashboard
---

# Activity

What your agents are doing right now, step by step.

Activity is the closest thing to watching over the agent's shoulder. Every
reasoning block, tool call, tool result and error appears as it happens, across
every runtime at once.

## The feed

Each row is one event:

- **Reasoning** — what the model was thinking, where the runtime persists it
- **Tool call** — the tool name and its arguments
- **Tool result** — what came back, including failures
- **Message** — user and assistant turns
- **Error** — anything the runtime recorded as a failure

Rows carry their session, runtime and timestamp, so a busy machine reads as one
interleaved stream you can filter rather than eight separate logs.

## Live streaming

The feed is served over Server-Sent Events, so it updates without polling:

```bash
curl -N localhost:8900/api/brain-stream
```

For OpenClaw and NemoClaw this is genuinely live — the daemon subscribes to the
gateway WebSocket and forwards events as they happen. For filesystem-backed
runtimes it is as live as the ingest cycle, which is seconds rather than
sub-second.

## Drilling into one event

Clicking a row opens the detail: the full arguments, the full result, the
timing, and — for model calls — the token split and the cost of that specific
call.

```bash
curl -s localhost:8900/api/brain-history | jq '.events[:5]'
curl -s localhost:8900/api/brain-event/<event_id> | jq
curl -s localhost:8900/api/llm-call-timeline/<event_id> | jq
```

## "Why did it do that?"

The `why` endpoint reconstructs the context around a decision — what the agent
had just seen when it made a particular call:

```bash
curl -s localhost:8900/api/brain/why/<session_id>/<event_id> | jq
```

This is the fastest route from "it did something baffling" to the actual reason,
and it is usually a tool result three steps earlier that said something the model
misread.

## Clusters

Long sessions produce a lot of events, most of them repetitive. The clusters
view groups similar activity so a two-thousand-event session reads as a dozen
phases rather than a wall.

```bash
curl -s localhost:8900/api/brain/clusters | jq
```

It is also how a loop becomes visually obvious before a detector formally flags
it: the same cluster, over and over, is the shape of an agent going nowhere.

## Deduplication

Events that arrive from more than one source — the gateway stream and the
transcript file, for instance — are collapsed. Without that, a live OpenClaw
session would show every step twice: once when the gateway announced it and
again when the transcript flushed.

## Related

- [Conversations](/docs/dashboard/conversations/) — the same sessions as readable transcripts
- [Guard](/docs/dashboard/guard/) — the detectors reading this same stream
- [Tracing](/docs/dashboard/developer/) — the span waterfall view