MCP audit log
Review tool invocation history with stats, charts, filters and pagination.
Overview
The Audit Log records every tool call that flows through the MCP Gateway. It's your compliance trail for agent activity, covering what was called, who called it, whether it succeeded and how long it took.
You'll find it at AI Gateway > Agent Control > Activity.
Summary stats
Four stat cards appear at the top of the page, summarizing activity for the selected time period:
| Stat card | What it shows |
|---|---|
| Total calls | Total number of tool invocations in the selected period. |
| Error rate | Percentage of tool calls that failed, shown as a percentage. Highlighted in red when errors exist. |
| Avg latency | Average round-trip time for tool calls in milliseconds. |
| Unique tools | Number of distinct tools that were called. |
Hover over any stat card to see a tooltip with more context.
Time period selector
A dropdown in the top-right corner controls the time window for summary stats and charts. Options are:
- Last 7 days (default)
- Last 14 days
- Last 30 days
Changing the period reloads the stats and charts. The log table below always shows the most recent entries regardless of this selector.
Charts
Two bar charts appear side by side when there's enough data:
- Top 10 tools by calls: Shows the most frequently invoked tools, ranked by total call count. Hover over a bar to see the exact number.
- Avg latency for top 10 tools: Shows average round-trip time per tool. Helps identify slow or bottlenecked tools. Values are in milliseconds.
Each chart has an info icon with a tooltip explaining what it measures. Both charts use the time period you selected.
Log entries
Below the charts, the "Recent tool calls" section lists individual log entries. Each entry shows:
| Field | Description |
|---|---|
| Tool name | The name of the tool that was called, in monospace font. |
| Status | Color-coded chip showing the outcome: success, error, blocked, rate_limited, approval_required, Would block or Would need approval. |
| Latency | Round-trip time in milliseconds. |
| Result summary | A truncated summary of the tool's response (up to 500 characters). Shows a dash if no summary is available. |
| Agent key | The name of the agent key that made the call. |
| Timestamp | When the call happened. |
Status values
Each log entry has one of these statuses:
- success: The tool was called and returned a result.
- error: The tool call failed (server error, invalid input, etc.).
- blocked: A guardrail rule blocked the call before it reached the server.
- rate_limited: The agent key exceeded its requests-per-minute limit.
- approval_required: The tool requires approval. An approval request was created.
- Would block: A monitor only agent key made the call, and a guardrail, or for a call through the MCP proxy the key's tool lists, would have blocked it. The call went through.
- Would need approval: A monitor only agent key made the call, and it would have needed approval. The call went through and no approval request was created.
Open a Would block or Would need approval entry to see the rule behind it, for example "Would have been blocked by No emails". When there is no rule, the drawer names the reason the gateway recorded: the key's tool list or the tool's own approval setting (both only for calls through the MCP proxy). Otherwise it says the call would have been blocked by a guardrail, or would have needed approval. Every match is also listed in the entry's events, labelled Would block or Would need approval, with the time it was checked.
Filtering logs
Two filters appear above the log entries:
- Filter by tool: Text field. Type a tool name (e.g., "greet") to show only calls to that tool.
- Status: Dropdown to filter by result status: All statuses, Success, Error, Blocked, Rate limited, Approval required, Would block or Would need approval.
Both filters work together. Changing either one resets the page to 1.
Pagination
The log table shows 20 entries per page. At the bottom you'll see:
- A counter showing which entries are displayed (e.g., "Showing 1-20 of 156").
- Previous and Next buttons to navigate between pages.
Backend API
The audit log exposes several API endpoints for programmatic access:
| Endpoint | Description |
|---|---|
| GET /mcp/audit/logs | List log entries with pagination and filters (agent_key_id, tool_name, result_status, start_date, end_date). |
| GET /mcp/audit/stats | Get summary statistics (total calls, error count, avg latency, unique tools, unique agents) for a given number of days. |
| GET /mcp/audit/stats/by-tool | Get call count and average latency broken down by tool name. |
| GET /mcp/audit/stats/by-agent | Get call count and average latency broken down by agent key. |
| POST /mcp/audit/cleanup | Delete audit logs older than the retention period. Called by scheduled job. |
| POST /mcp/audit/cleanup-approvals | Delete decided/expired approval requests older than the retention period. |
Data retention
Admins set how long audit logs are kept in Settings → Data retention, under Agent Control logs. Each organization can keep the deployment default or set its own period in whole days, from the deployment's minimum (7 by default) up to 3650. A daily cleanup removes logs and decided or expired approval requests older than the period. Pending approvals that have not expired are kept.
Empty state
If no audit logs exist yet, you'll see a tip explaining how to generate them: "Make tool calls through the MCP Gateway using an agent key at POST /v1/mcp with the tools/call method."
Using audit logs for compliance
The audit log directly supports EU AI Act Article 12 (record-keeping requirements for high-risk AI systems). Every tool invocation is recorded with:
- Who made the call (agent key identity)
- What was called (tool name and arguments)
- When it happened (timestamp)
- What happened (status, result summary, latency)
- Whether it was blocked, rate-limited or required approval