MCP audit logs: a record of every tool call
Statio records every tool call through the gateway and every change to who can make them, refusals included, so you can say which agent called which tool and whether it was allowed.
Why MCP needs one place to look
MCP leaves logging to each server
Every server logs differently, many log nothing, and the client on a laptop keeps whatever it keeps. When someone asks which agent deleted those rows last Tuesday, the honest answer is often that nobody can say.The questions a review asks are specific
Who called which tool, on which server, when, with what result. Which calls were refused. Who changed whose access. A log that cannot answer those is a debugging aid, not an audit trail.
Two logs, two questions
Two logs, filling in
Activity
alloweddb.selectRowspostgres · agent ci-agent · 200 · 42ms
allowedissues.creategithub · user alex@acme · 200 · 61ms
alloweddb.selectRowspostgres · agent ci-agent · 200 · 38ms
faileddb.deleteRowspostgres · agent ci-agent · 403 · 3msYou don't have permission to call tool 'db.deleteRows'
Audit Logs
successalex@acme denied db.deleteRows for agent ci-agent
Webhook to your SIEM
POSThttps://siem.acme.dev/statio
X-Statio-Signature:v1=9f2c…e41a
On Business and up, a webhook delivers both logs to your SIEM. Each delivery is signed in the X-Statio-Signature header, so your side can check it came from Statio.
| Activity | Audit Logs | |
|---|---|---|
| What it records | Every tool call through the gateway | Every administrative change |
| Each entry | Tool, server, caller (user, agent or unattributed), result, status code, latency | The action as a sentence, who did it, and the result |
| Results | Allowed or failed, with refusals as failed 403s | Success, failed or denied |
| Kept on every plan | 30 days | 90 days |
What makes it an audit trail
Refusals are first-class
A call the gateway refuses is recorded with the tool and the caller, as a failed 403: “You don’t have permission to call tool ’deleteRows’”. A call blocked by threat scanning shows “Request blocked by security policy”.Credentials never appear
Upstream keys are attached inside the gateway after the access check, and are never logged in plaintext. Entries record which server was called, not the secret used to call it.Agents are named
Because agents have their own identity, the caller column says which agent acted rather than which person set it up. See agent identity.Into your SIEM
From Business up, webhooks deliver the Activity log, the Audit Logs or both to your SIEM. Each delivery is signed with HMAC in the X-Statio-Signature header, so your side can verify it came from Statio.
What gets refused is set by per-tool permissions, and how agents are named is covered in agent identity. The full security model is on the security page.
Questions
Every plan keeps 90 days of audit log and 30 days of call activity. Enterprise retention is set per contract, up to two years. Business adds SIEM export, so you can keep records in your own system as long as you need.
Activity entries record the call, its caller and its outcome. Tool-call arguments and output pass through threat scanning on the way, and a blocked call is recorded as blocked.
Statio has no completed compliance certification, and we will not imply one. The logs are built to answer the questions an auditor asks about access and activity, and exports go to your SIEM in your own retention.
Lock down your first tool in minutes.
Three MCP servers, one of them hosted, and 10,000 calls a month, free and without a card. If you outgrow it the next plan is $19.
Two steps: create your account, then install the desktop app on each machine that runs an AI client.
- Keys encrypted at rest, never handed to an agent
- Cancel anytime, nothing is deleted
- How Statio handles credentials