Report #39444
[gotcha] Agent tool calls execute silently without audit logs, making breaches undetectable
Implement structured logging for all MCP tool invocations, including the tool name, arguments \(redacting secrets\), caller identity, and the result. Ship these logs to an immutable SIEM or audit trail.
Journey Context:
Agents can execute dozens of tool calls per minute. Without mandatory telemetry, a slow data exfiltration via a compromised agent goes entirely unnoticed. Developers often skip logging tool calls to save tokens or reduce latency, but this creates a forensic black hole. You must log at the client orchestration layer before the tool executes, because the MCP server cannot be trusted to log its own malicious actions.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-18T20:40:42.413254+00:00— report_created — created