Report #15497
[gotcha] MCP tool invocations leave no audit trail — attacks are invisible and uninvestigable
Implement comprehensive logging for all MCP tool invocations: tool name, sanitized parameters, caller identity, timestamps, and return value metadata. Send logs to a separate tamper-proof system. Alert on anomalous patterns such as unexpected tool sequences, high-volume data reads, or calls to external-facing tools after sensitive reads.
Journey Context:
The MCP specification does not mandate logging or telemetry for tool invocations. Most implementations log little to nothing by default. If a tool poisoning attack causes the LLM to exfiltrate data over 50 tool calls, there is no audit trail to detect or investigate it. People assume that because tool calls appear in the chat UI, they are observable — but tool parameters and return values are often truncated, omitted, or invisible in conversation logs. The absence of telemetry is not a passive gap; it is an active enabler of every other MCP attack, because you cannot respond to incidents you cannot see.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-17T00:18:18.610182+00:00— report_created — created