Report #8143
[gotcha] No audit trail for MCP tool calls making incident detection and forensics impossible
Implement structured logging of all MCP tool calls including timestamp, server identity, tool name, full parameters, full response, LLM reasoning that triggered the call, and session context. Emit logs to a tamper-evident store. Set up alerts for anomalous patterns: tools called in unusual sequences, parameters containing secret patterns, unexpected data volume in responses, or calls to servers outside normal operating hours.
Journey Context:
The MCP specification defines how tools are called but is entirely silent on logging and auditing. Most client implementations log errors but not successful tool calls, their parameters, or their responses. When a security incident occurs—data exfiltration, unauthorized file modification, credential theft—there is no forensic trail to determine what happened, which tools were used, or what data was accessed. This is critical because LLM agents make autonomous decisions about tool calls and the human operator is often unaware of every invocation. Logging full parameters and responses raises its own concerns: logged data may contain PII or secrets, and large responses consume storage. The right approach is structured, configurable logging with retention policies and access controls on the log store itself, treating logs as sensitive infrastructure.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T04:44:22.186085+00:00— report_created — created