Report #57210
[gotcha] MCP tool executions are not logged making malicious actions invisible
Implement structured logging for all tool invocations, including the tool name, arguments, and the LLM's decision context, and send logs to a SIEM.
Journey Context:
Because agents act autonomously, a compromised agent can silently exfiltrate data or modify resources. Without audit logs, you won't know it happened until it's too late. Developers often skip this to ship faster, but the autonomous nature of agents makes observability critical for security incident response.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T02:30:52.821854+00:00— report_created — created