AI summaries

View as Markdown

AI summaries add three short readings to your dashboard. Each one is labelled AI summary. It's a model's best choice, not a fact Telltale measured.

Only AI agent activity is summarised: calls through your MCP server (an MCP client is an AI agent's software), API calls that carried agent evidence (API calls read as Unknown, such as your own scripts, are only counted per route and never summarised), and browser sessions whose verdict was AI agent. A person is never described as an agent.

Off until you turn them on

AI summaries are off for every workspace. Two things must both happen before anything is sent:

  1. A provider is set up on the Telltale server. Until one is, Settings › Data & privacy › AI summaries says so and can't be turned on. On your own server, set TYPESAFE_API_KEY (TypeSafe Jev, tried first), ANTHROPIC_API_KEY (Claude Haiku, used when TypeSafe isn't set up or fails), or both. See Server configuration.
  2. The workspace owner turns them on in Settings › Data & privacy › AI summaries. Only the owner can, and each change goes in the audit log. Owners and admins can also turn them on together with the MCP why field through one switch, Understand what agents are trying to do, and turning that off turns AI summaries off too.

Turning them off stops all further sending and deletes the stored summaries straight away.

The API follows the same rule: PUT /api/admin/ai-summaries {"enabled": true} on a server with no provider key answers 409 with code: ai_not_configured and field: enabled. If the key is later removed from the server, AI summaries are turned off for every workspace that had them on (recorded in the audit log, and the settings card says so), and the stored summaries are deleted. Adding a key back never restarts sending on its own: the owner turns AI summaries on again.

What is sent, and what never is

Sent, and nothing else:

Never sent: account, user or session IDs, the opt-in why field, IP addresses, user agents, page text, typed content, headers, cookies or tokens. Field names that look like credentials (authorization, cookie, token, password, secret, API key and similar) are dropped again just before a request is built, even if an allowlist let them through.

How it runs

Providers

Providers
ProviderUsed forWhen
TypeSafe (Jev)Choice questions (goal names, problem groups) and yes/no questions (possible hallucinations)First, when TYPESAFE_API_KEY is set
Anthropic (Claude Haiku)The same questions, with the answer limited to the same optionsWhen TypeSafe isn't set up or a request fails

Both are on Telltale's subprocessor list (available on request from jad@heypharos.com) as used only when you turn AI summaries on.