admin

@neuralis/admin is the management layer of the platform — where the owner and admins govern a workforce of humans and agents: who is in which project, what each role may do (feature grants and role priority), what everything costs, which secrets exist at which scope, and what happened, recorded in an append-only audit log. It is a builtin, first-party package with an embedded (in-process) runtime binding, and it owns the Admin widget plus the administrative backend surface: system health, dashboard statistics, user and project inventory, role and limit metadata, platform configuration, encrypted credentials, audit and log views, vector-store maintenance, and an organization canvas.

This section documents the package itself — its features, routes, UI, skills, and security posture. For the operational story (how to run a deployment as an administrator), see Administration.

ResponsibilitiesCopy Anchor Link

• System overview — health checks (vector store, disk, memory, configured LLM providers), per-package status, active streams, and dashboard KPIs.
• Usage analytics — time-bucketed token/cost series, grouped by model, agent, user, or project, aggregated server-side.
• Users and projects — read inventory of your projects' users (the whole platform with platform.users) and projects, with member, role, and limit detail per project.
• Platform configuration — file-backed runtime settings editable through the Config tab; environment-derived settings shown as read-only rows.
• Roles — the role catalog (feature grants and role priority), edited per project or platform-wide.
• Credentials — the scope-aware encrypted credential store (platform / project / user / agent), surfaced in the Credentials tab and through the manage-credentials skill. See Credentials.
• Audit and logs — audit event reader and per-source log views.
• Vector store — status probe of the vector database and embedding host, the active and target embedding models with the rebuild that moves between them, your own embedding endpoints, plus an explicitly-confirmed destructive reset.
• Organization canvas — an interactive graph of users, agents, and their ownership/assignment relationships.

What the manifest declaresCopy Anchor Link

The package manifest provides two feature tiers. A project.* feature acts inside the caller's current project; a platform.* feature crosses the project boundary.

Default role grants give every role project.dashboard, so all members see the system overview. The admin role receives every project-tier feature above; the owner role holds the '*' wildcard. No platform.* feature is granted to any role by default — an owner grants them explicitly. The full gating model is described in Features and access.

The manifest also declares:

• A singleton widget surface (type: "admin", Shield icon) rendered frameless and transparent over the workspace background, plus a matching dock entry on the bottom rail. Both require project.dashboard.
• A uriPolicies baseline for its own data zone: data://<self>/** is read-write by default, while the data://<self>/audit/** subtree is read-only (writes disabled for all roles). Read access to audit content is gated at the route layer by project.audit (and platform.audit for the organization-wide log), not by the path policy. See URI policies.
• Two platform config settings (configSettings[]) the package owns and reads live on every call: qdrantProbeTimeoutMs (default 3000 ms, range 250–30000) for the vector-database probes, and adminLogsReadMaxLines (default 500, range 100–10000), the per-request line cap on log reads — there is no paging, so it is the maximum forensics depth reachable in one request. Both are edited from the Config tab like any other declared key; see Configuration.
• One declared source instance (sources[]) — the platform App Zone on brain-core's local kind, rooted at the platform app directory, user-scoped and write-protected (read: true, write: false, exec: false). Seeing and attaching it requires drive.mount.privileged, a feature with no grant below the admin tier. See Manifest.
• Trust tier first-party, embedded runtime binding, and no hosted MCP surfaces.

The package ships no tools and no commands — its model-facing surface is the five management skills plus the feature-gated routes those skills wrap.

Folder mapCopy Anchor Link

admin has no tools/ folder; its real package folders map to these pages:

In this sectionCopy Anchor Link