MCP access audit
See every MCP tool call, connection and redaction, who made it, and which rule allowed or blocked it
When a tool call is blocked, a server returns something it shouldn't, or someone asks who touched Salesforce last week, you need the record behind it. Agent Trail records every MCP tool call the gateway handles, with the agent, the person it acted for, and the rule that decided it.
What's recorded for MCP traffic
| Event | What it records |
|---|---|
| Tool executed | Each tool call: the tool, the MCP server, and whether it ran or was denied |
| Tool error | A failed call and its error type, such as rate_limited when a usage limit refused it |
| Tool search | Each tool search and the tools it returned, but not the query |
| Redaction | Which response filters redacted a response, and how many spans each matched |
| Agent connected | Each MCP session an agent starts, with the servers it could reach, was blocked from, or couldn't reach |
| Tools synced | Each time the gateway reads a server's tools, with any tools it added or changed |
Each entry has the time, the actor (the agent or person), the action, the server, and details for that action. A tool call also shows the IP address and user agent it came from.
See which rule decided a call
Expand a tool call to see the rule that allowed or blocked it, linked to the rule in Agent Access. A call that matched no rule was denied by default.
Expand an Agent connected entry to see what the agent could use when it connected. Each server lists its tools under the rule that decided them: allowed, conditionally allowed by an argument-level condition checked on every call, or denied. A blocked server names the rule that blocked it.
See what was redacted
A tool call whose response was redacted carries a Redacted ×N badge, where N is the number of spans replaced. Hover it to see how many each filter matched. Agent Trail stores the filter names and counts, never the redacted text.
Find MCP activity
Filter Agent Trail to the traffic you care about:
| To answer | Filter by |
|---|---|
| Who used a server | MCP, with Action set to Tool Executed |
| What one person's agents did | User, or Group for a team |
| What every Claude Code client did | Agent |
| What one connected client did | Agent instance |
| Calls to sensitive servers or tools | Resource tag, such as finance |
| Calls by agents that act for no one | Autonomous, set to Only |
Most filters can also exclude a value, such as every server except one. See Agent Trail.
What end users see
People see their own tool calls, tool searches and connections on the Activity page of the user portal. They don't see which rule decided a call, which servers or tools were blocked, or which filters redacted a response.
Keep the record longer
Agent Trail keeps three months of history. To keep MCP activity longer, or to investigate it in your SIEM, forward it as it happens with Event forwarding.
Next steps
You can now find any MCP tool call, see who made it and which rule decided it, and keep the record as long as you need. Next, forward it to your SIEM.
- Agent Trail – every event type, not just MCP traffic
- Event forwarding – send events to your SIEM as they happen