Skip to Content
Administrator ManualAuditMCPRequest Audit

Request Audit

Overview

MCP Audit lets you audit MCP proxy usage and changes to MCP access permissions in QueryPie.

  • Request Audit: View MCP request processing history
  • MCP Server Role History: View the history of MCP roles granted to or revoked from users or groups

In other words, Audit Settings on the MCP Server settings screen determines what to record, while the screens for viewing the recorded audit history are provided separately under Admin > Audit > MCP.

  • Menu path: Admin > Audit > MCP

  • Submenus

    • Admin > Audit > MCP > Request Audit
    • Admin > Audit > MCP > MCP Server Role History

  • Required permission: PERMISSION_MAC_AUDIT

Understanding Request Audit

Request Audit shows how MCP requests were processed within each scope.

The following two types of logs can be recorded together on this screen.

  • CLIENT: Requests sent from a client to the MCP proxy
  • PROXY_UPSTREAM: Requests forwarded from the MCP proxy to an individual upstream MCP Server

Therefore, a parent request and its upstream child requests may appear together for a single user request.

Opening Request Audit

  1. Go to Admin > Audit > MCP > Request Audit.
  2. When the screen opens, it displays logs for the current date by default.
  3. Adjust the filters at the top to query only the log range you need.
  4. Click the refresh button in the upper-right corner to reload the list with the current conditions.

Searching and filtering Request Audit

The Request Audit screen provides the following default filters.

  • Server: View only upstream logs related to a specific MCP Server
  • Event: ALLOW, DENY
  • Request Scope: CLIENT, PROXY_UPSTREAM
  • Executed At: Time range when the logs occurred

The list uses cursor-based pagination, and you can load additional logs by scrolling.

Information available in the Request Audit list

The list contains the following columns.

  • No: Log sequence number
  • Executed At: Time when the request was recorded
  • Request Origin: CLIENT or PROXY_UPSTREAM
  • Root Request ID: Parent request ID that groups the same request flow
  • Event: Permission or policy decision (ALLOW, DENY)
  • Status: Actual processing result (SUCCESS, ERROR)
  • Name: Name of the user who made the request
  • Email: Email address of the user who made the request
  • Client IP: IP address of the client that sent the request
  • Server: Name of the target MCP Server
  • Method: MCP method name
  • Client Tool Name: Tool name requested by the client
  • Target Tool Name: Tool name resolved for the upstream target
  • Duration: Processing time (ms)

Event and Status have different meanings. For example, even when Event is ALLOW, Status may be recorded as ERROR if an error occurs during execution.

Viewing Request Audit details

Click a row in the list to open the detail drawer.

The detail drawer shows the following information.

Request Info

  • Request ID: Unique ID of the individual audit log record
  • Root Request ID: ID that groups logs belonging to the same request chain
  • Request Origin: CLIENT or PROXY_UPSTREAM
  • Executed At: Time when the request was recorded
  • Server: Name of the target MCP Server
  • Method: MCP method and tool name
  • Client Tool Name: Tool name from the client’s perspective
  • Target Tool Name: Actual upstream target tool name
  • Transport: Transport used to communicate with the upstream MCP Server
  • Upstream Endpoint: Upstream MCP Server endpoint
  • HTTP Status: HTTP processing status code
  • Event: Allow or deny event
  • Status: Success or failure status
  • Duration: Processing time
  • Denied Reason or Error: Denial reason or error message

Subject Info

  • Name
  • Email
  • Subject ID

Client Info

  • Client IP
  • User Agent

Payload

If the payload was stored, you can view the request body in JSON format in the Payload section.

However, payload visibility depends on the audit settings.

  • Client-originated requests are affected by the client audit payload setting in Admin > MCP Servers > General > Configurations.
  • Upstream requests are affected by Include payload in Request Audit on each MCP Server detail page.

Values identified as sensitive information may be masked instead of being stored as-is.

The current admin Request Audit detail screen displays the Payload, but does not expose an internally stored response body in a separate section.

Notes on interpreting Request Audit

  • Logs with the same Root Request ID are part of the same request flow.
  • A CLIENT log represents a request sent by a user to the MCP proxy.
  • A PROXY_UPSTREAM log represents a downstream request forwarded by the proxy to a specific MCP Server.
  • Server, Transport, Upstream Endpoint, and Target Tool Name are primarily meaningful for PROXY_UPSTREAM logs.
  • Server information may be empty in a CLIENT log.
Last updated on
MCPMCP Server Role History