Skip to main content

​
What this is for

gw-cli serve opens a local dashboard — served from the machine itself, at http://localhost:8789 by default — that shows everything discovery found: skills grouped by project with risk badges, the agent extension surface, MCP servers, tools, an Accounts summary, and (on macOS) any live captured traffic. It stays current on its own, rescanning within seconds of a file change. Like the rest of gw-cli, the dashboard is endpoint-local: it reads the encrypted store under ~/.guardway and uploads nothing.
Guardway CLI local dashboard

​
Options

​
Tabs

The dashboard header reads Guardway — Endpoint and carries these tabs:
TabWhat it shows
SkillsDiscovered skills, grouped by project, each with a risk badge.
Add-onsCommands, hooks, subagents, and plugins — risky ones flagged ⚠.
AgentsDiscovered agent projects.
MCP serversRegistered MCP configs and their findings.
ToolsThe AI tools / apps detected on the machine.
RuntimeLive captured LLM traffic (populated by mitm on macOS).
Above the tabs, an Accounts summary shows each tool’s account as corporate or personal.

​
OWASP compliance panel

Near the top, an OWASP Agentic Skills Top 10 panel scores this machine against the framework: an overall compliance % plus a tile per item (AST01–AST10), each PASS / ATTENTION / FAIL with its finding and artifact counts. It updates on every rescan. AST09 (Governance) reads as ATTENTION until you record an approval baseline with gw-cli approve; after that, anything new or changed shows up as a GOV-UNAPPROVED finding. See OWASP Agentic Skills Top 10.

​
Freshness & Rescan

  • The header shows a live freshness indicator — “updated Xs ago.”
  • serve watches your project folders and rescans within seconds of any change, plus a periodic sweep, and prunes anything you delete — no manual step needed.
  • A Rescan button forces an immediate re-scan. Use it instead of running discover in a second terminal (only one process can hold the store at a time).

​
How to configure

1

Populate the store

Run an inventory first so the dashboard has something to show:
gw-cli discover --deep
2

Start the dashboard

gw-cli serve                 # → http://localhost:8789
gw-cli serve --port 9000     # → http://localhost:9001
gw-cli serve --no-open       # don't auto-open a browser
Stop it with Ctrl-C.
3

Keep it fresh without a running process

Prefer a scheduled refresh over an always-on server:
gw-cli schedule --interval daily --at 09:00
It re-runs discover --deep on a cadence and exits; open serve whenever you want to look.
4

Or run it always-on

The packaged install-service.sh keeps the dashboard live at http://localhost:8789, auto-updating on file changes, so you don’t need to keep a terminal open.

​
Limits

  • The dashboard is local-only — it is not the Guardway platform dashboard and does not send data to the control plane.
  • Only one gw-cli process can use the store at a time; the Rescan button exists so you don’t need a second discover run while serve is up.
  • The Runtime tab is populated by live capture (gw-cli mitm), which is macOS-only.