diff --git a/CHANGELOG.md b/CHANGELOG.md
index ec628fc..d770c25 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# v1.22.0
+- feat: Agents page — live list of connected theta-agent hosts with telemetry (CPU/RAM/disk/ZFS/GPU) + online status, updating via socket.io
+- security: auth + admin-gate the /api/agent REST routes (previously unauthenticated)
+
 # v1.21.0
 - fix: always reconcile OpenBao policy content before serving a (possibly cached) token, so stale stored policies can no longer cause a recurring vault 403 "permission denied"
 - feat: shared secrets — users can publish secrets to secret/shared/<owner>/<slug> and grant read access to other users and downstream apps (OpenBao ACL policy edits, applied live)
diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json
index ec5fde9..36d3b61 100644
--- a/nodejs/package-lock.json
+++ b/nodejs/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
diff --git a/nodejs/package.json b/nodejs/package.json
index 81774f7..2b65c56 100755
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {
diff --git a/nodejs/routes/api_agent.js b/nodejs/routes/api_agent.js
index 9a600a7..72ec137 100644
--- a/nodejs/routes/api_agent.js
+++ b/nodejs/routes/api_agent.js
@@ -1,8 +1,12 @@
 'use strict';
 
 const express = require('express');
+const middleware = require('../middleware/auth');
+const permission = require('../utils/permission');
 const agentManager = require('../utils/agent_manager');
 
+const ADMIN_GROUPS = ['app_sso_admin', 'app_super_admin', 'app_sso_directory_admin'];
+
 module.exports = function initAgentWebSockets(app) {
   if (!app.wss) {
     console.warn("WebSocket server for agents is not initialized.");
@@ -71,8 +75,23 @@ module.exports = function initAgentWebSockets(app) {
     } catch (e) {}
   });
 
-  // REST API routes for Agent Management (mounted under /api/agent)
+  // REST API routes for Agent Management (mounted under /api/agent). The agent
+  // WebSocket (/api/agent/ws) is handled by the raw `wss` upgrade server in
+  // bin/www with its own ?token= auth — unaffected by the express middleware
+  // here. These REST routes are admin-facing, so they're auth + admin gated.
   const router = express.Router();
+  router.use(middleware.auth);
+  router.use(async (req, res, next) => {
+    try {
+      await permission.byGroup(req.user, ADMIN_GROUPS);
+      next();
+    } catch (err) {
+      if (err && (err.status === 401 || err.name === 'Insufficient Permission')) {
+        return res.status(403).json({ status: 'error', message: 'admin only' });
+      }
+      next(err);
+    }
+  });
 
   router.get('/nodes', (req, res) => {
     res.json({
diff --git a/nodejs/routes/index.js b/nodejs/routes/index.js
index 144a4a3..0f07641 100755
--- a/nodejs/routes/index.js
+++ b/nodejs/routes/index.js
@@ -59,6 +59,12 @@ router.get('/overview', function(req, res) {
   res.render('overview', {...values});
 });
 
+// Connected theta-agent hosts + live telemetry (admin). Data from
+// GET /api/agent/nodes; live updates via socket.io 'agent.*' events.
+router.get('/agents', function(req, res) {
+  res.render('agents', {...values});
+});
+
 router.get('/admin', (req, res) => res.redirect(301, '/overview'));
 router.get('/notifications', (req, res) => res.redirect(301, '/overview'));
 router.get('/dashboard', (req, res) => res.redirect(301, '/overview'));
diff --git a/nodejs/utils/ui.js b/nodejs/utils/ui.js
index 4128e3d..d35af61 100644
--- a/nodejs/utils/ui.js
+++ b/nodejs/utils/ui.js
@@ -46,6 +46,7 @@ module.exports = {
 		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
 		// Vault requires login - per-user secrets at secret/users/<uid>/*.
 		{href: '/vault', icon: 'fa-solid fa-vault', label: 'Vault', groups: ['login']},
+		{href: '/agents', icon: 'fa-solid fa-microchip', label: 'Agents', groups: ['app_sso_admin', 'admin']},
 		{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},
 	],
 };
diff --git a/nodejs/views/agents.ejs b/nodejs/views/agents.ejs
new file mode 100644
index 0000000..2f8662d
--- /dev/null
+++ b/nodejs/views/agents.ejs
@@ -0,0 +1,112 @@
+<%- include('top') %>
+
+<div class="container-fluid py-4">
+  <div class="d-flex justify-content-between align-items-center mb-3">
+    <h2><i class="fa-solid fa-microchip"></i> Theta Agents <small class="text-muted">(connected hosts)</small></h2>
+    <button class="btn btn-outline-primary" onclick="loadAgents()"><i class="fa-solid fa-rotate"></i> Refresh</button>
+  </div>
+
+  <div class="card shadow-sm">
+    <div class="card-header bg-light"><h5 class="card-title mb-0">Connected agents</h5></div>
+    <div class="table-responsive">
+      <table class="table table-hover align-middle mb-0">
+        <thead class="table-light">
+          <tr>
+            <th>Host</th>
+            <th>IP</th>
+            <th>Status</th>
+            <th style="width:110px">CPU</th>
+            <th style="width:110px">RAM</th>
+            <th style="width:110px">Disk</th>
+            <th>ZFS</th>
+            <th>GPU</th>
+            <th>Last seen</th>
+          </tr>
+        </thead>
+        <tbody id="agents-tbody">
+          <tr><td colspan="9" class="text-center text-muted">Loading agents...</td></tr>
+        </tbody>
+      </table>
+    </div>
+  </div>
+
+  <p class="text-muted small mt-3">
+    Live data from the theta-agent telemetry stream. An agent reports hostname/IP discovery and
+    CPU/RAM/disk/ZFS/GPU usage every ~60s over the WebSocket; "Online" means seen in the last 90s.
+  </p>
+</div>
+
+<script type="text/javascript">
+  app.auth.forceLogin(['app_sso_admin', 'admin']);
+
+  let agentsById = {}; // token -> agent record
+
+  function bar(val) {
+    val = Math.max(0, Math.min(100, val || 0));
+    return `<div class="progress" style="height:8px"><div class="progress-bar" role="progressbar" style="width:${val}%"></div></div>`;
+  }
+  function timeAgo(iso) {
+    if (!iso) return '';
+    const m = moment(iso);
+    return m.isValid() ? m.fromNow() : '';
+  }
+  function esc(s) {
+    if (s == null) return '';
+    return app.util.escapeHtml(String(s));
+  }
+
+  function renderRow(id, a) {
+    const d = a.discovery || {};
+    const t = a.telemetry || {};
+    const online = !!a.isOnline;
+    const badge = `<span class="badge ${online ? 'bg-success' : 'bg-secondary'}">${online ? 'Online' : 'Offline'}</span>`;
+    const cpu = t.cpu_usage_percent != null ? t.cpu_usage_percent : 0;
+    const ram = t.ram_usage_percent != null ? t.ram_usage_percent : 0;
+    const disk = t.disk_usage_percent != null ? t.disk_usage_percent : 0;
+    const gpu = (t.gpu_usage_percent != null && t.gpu_usage_percent >= 0) ? t.gpu_usage_percent + '%' : 'N/A';
+    return `<tr id="agent-${id}">
+      <td><strong>${esc(a.hostname || 'unknown')}</strong>${d.location ? `<div class="small text-muted">${esc(d.location)}</div>` : ''}</td>
+      <td>${esc(a.ipAddress || '')}</td>
+      <td>${badge}</td>
+      <td>${cpu}% ${bar(cpu)}</td>
+      <td>${ram}% ${bar(ram)}</td>
+      <td>${disk}% ${bar(disk)}</td>
+      <td>${esc(t.zfs_health || 'N/A')}</td>
+      <td>${gpu}</td>
+      <td class="small text-muted">${timeAgo(a.lastSeen)}</td>
+    </tr>`;
+  }
+
+  async function loadAgents() {
+    const tbody = document.getElementById('agents-tbody');
+    try {
+      const res = await app.api.get('agent/nodes');
+      const agents = (res && res.agents) || [];
+      agentsById = {};
+      agents.forEach(a => { agentsById[a.token] = a; });
+      tbody.innerHTML = agents.length
+        ? agents.map(a => renderRow(a.token, a)).join('')
+        : '<tr><td colspan="9" class="text-center text-muted">No agents connected.</td></tr>';
+    } catch (err) {
+      tbody.innerHTML = `<tr><td colspan="9" class="text-center text-danger">Error loading agents: ${esc(err && err.message || err)}</td></tr>`;
+    }
+  }
+
+  // Live updates from the server's agent.* socket.io broadcasts. The app's
+  // default socket is scoped to P2PSub, so open a dedicated socket here.
+  const agentSocket = io({ auth: { token: app.auth.getToken() } });
+  agentSocket.on('agent.telemetry', (msg) => {
+    const a = agentsById[msg && msg.token];
+    if (a) { a.telemetry = msg.payload; a.isOnline = true; const row = document.getElementById('agent-' + msg.token); if (row) row.outerHTML = renderRow(msg.token, a); }
+  });
+  agentSocket.on('agent.discovery', (msg) => {
+    const a = agentsById[msg && msg.token];
+    if (a) { a.discovery = msg.payload; a.hostname = (msg.payload && msg.payload.hostname) || a.hostname; const row = document.getElementById('agent-' + msg.token); if (row) row.outerHTML = renderRow(msg.token, a); }
+  });
+
+  loadAgents();
+  // Re-fetch periodically to reflect connect/disconnect + isOnline (90s window).
+  setInterval(loadAgents, 30000);
+</script>
+
+<%- include('bottom') %>