Kneo Agent Dashboard

The operations and admin UI for the Kneo Agent Platform.

The Dashboard answers the operator's five questions — what is running, what is stuck, what needs human action, what changed, is production healthy? — and launches agents for real: it compiles a Studio-produced spec and runs it in a target environment (staging / production), gated by that environment's policies and credentials.

The split with Kneo Agent Studio is by environment: Studio authors and generates specs and proves they compile and test-run in dev / local; the Dashboard compiles and runs them operationally and monitors the result.

Architecture

React/TS SPA  ──/api/*──▶  FastAPI BFF  ──▶  kneo_client.platform (ops)        ──/v1──▶  kneo-serv
 (frontend)                (backend)         kneo_client.agent.specs (launch)
                                             (auth / retries / idempotency / ...)

• Backend — a thin FastAPI BFF over kneo_client. It bridges the operator session to a kneo_client profile, aggregates view-models, and streams traces over SSE. It uses the platform layer for operations and the agent.specs layer (validate / compile / policy-report) for env-gated launch. It owns no platform semantics — kneo_client is its only Kneo dependency, and it reaches the platform solely at runtime over /v1.
• Frontend — a React + TypeScript SPA that talks only to the BFF.

Surfaces

Admin — Launch (Load → Deploy → Run) · environment policies · credential reference inventory · settings.

Operate — runs and debugging with run control (Stop / Resume) · trace tail / checkpoints / replay and diff · human-in-the-loop queue · audit and compliance · operational health.

Deployment security

The Dashboard authenticates operators via OIDC (Authorization Code + PKCE) and enforces role-based access server-side in the BFF. Every privileged action (Launch Run, Stop / Resume, HITL resume, policy / Settings writes) is authorized against the operator's role before it reaches /v1, and refused or failed attempts are audited. The unauthenticated static mode is dev-only.

Run

The published wheel bundles the built SPA, so a bare install serves the full UI and API same-origin — no container, no separate SPA build:

pip install kneo-dash
kneo-dash          # serves UI + /api on 127.0.0.1:8090

Configure via KNEO_URL / KNEO_API_KEY (or a profile) and set KNEO_DASH_AUTH_MODE=oidc for any real deployment. A container image is also published for orchestrated deploys.

Ready-to-run deployment examples — an eval stack, a production shape (OIDC + Postgres + TLS proxy), and an annotated env file — are in the examples.