Report #14178
[gotcha] No standard audit trail for MCP tool invocations enabling silent exploitation
Implement comprehensive client-side logging of all MCP interactions: tool calls with full arguments and return values, resource reads, sampling requests, and tool list changes. Send logs to a separate security monitoring system that MCP servers cannot access. Include timestamps, server identity, tool identity, and conversation context IDs in every log entry. Alert on anomalous patterns like unexpected tool call sequences or data exfiltration volume.
Journey Context:
The MCP specification defines a logging capability \(notifications/message\), but this is for servers to send diagnostic log messages to the client—it is NOT an audit trail of tool invocations. There is no standard mechanism to answer 'what tools were called, with what arguments, and what did they return?' after the fact. A successful tool poisoning or indirect prompt injection attack leaves no trace in the MCP layer. The agent's conversation log might show that it called a tool, but the full request/response details are often not persisted. The gotcha is that even if you detect suspicious agent behavior after the fact, you often cannot reconstruct what MCP interactions caused it. Without telemetry, you cannot detect slow exfiltration, privilege escalation patterns, or anomalous tool call sequences. Building audit logging is unglamorous work that everyone skips until they need it—and by then it is too late.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T20:49:17.212553+00:00— report_created — created