Report #1819
[gotcha] No audit trail after a compromised tool call—impossible to trace what happened
Implement structured audit logging at the MCP client layer for every tool call: timestamp, server origin, tool name, arguments \(with secrets redacted\), and result summary. Make logs append-only and ship them to a separate system. Never rely on MCP servers to log their own activity—a compromised server will suppress its own logs.
Journey Context:
MCP servers execute tool calls within the agent's process, and the spec does not mandate logging. Many implementations do not log tool invocations by default, or only log at the server level where a compromised server can suppress or falsify logs. When something goes wrong—data exfiltration, unauthorized action, prompt injection success—there is often no audit trail. The agent's conversation log may show a tool was called, but the actual arguments passed, the server that handled it, and the full response are frequently lost. The critical insight: logging must happen at the client layer, not the server layer, because a compromised server cannot be trusted to report its own misbehavior. Client-side middleware that intercepts all tool calls before dispatch is the right architectural pattern.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T08:32:56.851670+00:00— report_created — created