Lookout.Storage.Sqlite 1.0.2

<div align="center"> <img src="assets/lookout-icon.png" alt="Lookout" width="72" />

<h1>Lookout for ASP.NET Core</h1>

<p>Minimal-config dev-time diagnostics dashboard for ASP.NET Core.</p>

<p> Captures HTTP requests, EF Core queries with N+1 detection, outbound HTTP, cache hits/misses,<br/> exceptions, logs, Hangfire jobs, and <code>Lookout.Dump()</code> — all correlated per-request in a browser dashboard. </p>

<img src="assets/lookout-demo.gif" alt="Lookout dashboard demo — N+1 detection in action" width="900" /> </div>

Install

dotnet add package Lookout.AspNetCore

For EF Core query capture (required in Clean Architecture / Infrastructure projects):

dotnet add package Lookout.EntityFrameworkCore

For Hangfire job capture:

dotnet add package Lookout.Hangfire

Quickstart

Three lines in Program.cs:

builder.Services.AddLookout();

app.UseLookout();
app.MapLookout(); // mounts the dashboard as a route on your app at /lookout

The dashboard is a route inside your existing app — same host, same port, no separate process. Run your app, then open https://localhost:{port}/lookout (where {port} is your app's port). Your first request appears the moment you hit any endpoint — no database setup, no configuration file.

Dev-only by default. Lookout throws LookoutEnvironmentException at startup if IsDevelopment() is false, unless you explicitly set AllowInProduction = true or AllowInEnvironments = ["Staging"]. There is no silent production exposure.

What it captures

All entries are correlated by request ID and searchable full-text (SQLite FTS5).

Screenshots

<table> <tr> <td><img src="assets/screenshots/dashboard-requests.png" alt="Request list with N+1 and signal badges" /></td> <td><img src="assets/screenshots/dashboard-n1.png" alt="Request detail with N+1 banner and EF queries" /></td> </tr> <tr> <td align="center"><em>Request list — signal badges surface db, http, cache, log, job counts</em></td> <td align="center"><em>N+1 banner — 12 identical queries grouped, stack trace to your code</em></td> </tr> </table>

Dashboard features

• Section-per-capture navigation — dedicated list page per capture type: Requests, Queries, Exceptions, Logs, Cache, Jobs, Dump, HTTP Clients
• Full-text search — Cmd+K / Ctrl+K across all entries and tags
• Keyboard navigation — j/k to move, Enter to open, Esc to go back
• Mini-Gantt timeline — per-request coloured bars for each capture type
• Dark mode — system / light / dark cycle, persisted across sessions
• Source links — stack frames open directly in VS Code or Rider
• Tag-based filtering — click any tag chip to filter across all sections
• "Copy as cURL" — on every request detail

Security

Lookout is built to stay safe in shared dev environments:

• Dev-only by default — throws at startup in Production unless explicitly opted in via AllowInProduction = true
• Loopback-only by default — warns at startup if bound to a non-loopback address; set AllowNonLoopback = true to suppress
• CSRF protection — all mutating endpoints require a double-submit cookie (__lookout-csrf) + X-Lookout-Csrf-Token header
• Retention bounded — 24-hour time window (configurable) + 50,000 entry cap; background pruning keeps storage in check

See the Security model docs page for the full picture.

Configuration

All options are set via AddLookout(options => { ... }). Everything has a sane default — you only touch what you need.

builder.Services.AddLookout(options =>
{
    options.RetentionWindow        = TimeSpan.FromHours(24); // default
    options.MaxEntries             = 50_000;                 // default
    options.CaptureRequestBody     = true;                   // default
    options.CaptureResponseBody    = true;                   // default
    options.Ef.N1DetectionMinOccurrences = 3;               // default

    // Allow in non-Production environments
    options.AllowInEnvironments    = ["Staging"];
});

Full reference at a-ghanem1.github.io/Lookout/docs/configuration.

Cache capture registration order: Call AddMemoryCache() and AddStackExchangeRedisCache() before AddLookout(). Lookout decorates these services at registration time and emits a startup warning if the order is wrong.

Documentation

Full docs at a-ghanem1.github.io/Lookout:

• Quickstart — under 2 minutes to first capture
• Configuration reference
• Custom capture points
• Security model
• Troubleshooting
• Comparison to MiniProfiler and Aspire Dashboard

Comparison

Lookout is complementary to both, not a replacement. MiniProfiler's in-page widget is great for timing SQL in production pages; Aspire Dashboard is a full production observability platform. Lookout is the tool you run during development when you want to understand exactly what a single request did.

Contributing

Issues and pull requests are welcome. The v2 wishlist issue tracks planned additions — a good place to find a first contribution.

Planned community PR targets post-v1: Quartz.NET, MassTransit, Wolverine, gRPC capture, IEmailSender / MailKit.

License

Apache 2.0 — see LICENSE.

Security

Found a vulnerability? Please report it privately — see SECURITY.md. Do not open a public issue.