{
  "id": 9112442,
  "title": "MCP security: what to log when an AI agent calls tools, and what the log can prove",
  "url": "https://urgent.news/2026/09/22/mcp-security-what-to-log-when-an-ai-agent-calls-tools-and-what-the",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-22T08:48:11.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/traceseal/mcp-security-what-to-log-when-an-ai-agent-calls-tools-and-what-the-log-can-prove-4l5e"
  },
  "original_language": "en",
  "account": "The Model Context Protocol (MCP) has become the default method for AI agents to access tools. While convenient for development, it creates challenges for logging and accountability when those agents interact with tools. This article examines what the current MCP specification requires, where those calls are typically recorded, and the limitations of that evidence when questioned by parties lacking trust.\n\nAccording to the 2025-11-25 revision, tools represent arbitrary code execution that must be handled with caution. Consent must be obtained before invoking any tool, and clients should seek confirmation for sensitive operations. However, these consent measures focus on permission rather than providing an audit trail.\n\nThe MCP specification itself does not mandate logging for tool calls. Instead, guidance on logging can be found in separate security best practices documents. These recommendations suggest logging key information such as token passthrough, scope minimisation, and proxy usage. While sensible, these requirements are minimal and do not dictate what should be recorded or who should log it.\n\nOne important consideration is the use of annotations with tool calls. Although four annotations are available, they are explicitly labeled as untrusted unless provided by a verified server. Dependencies on these annotations for logging purposes are therefore unreliable, as attackers could manipulate them. Consequently, a log entry that only states a read-only tool was invoked without confirmation does not capture the actual behavior of the tool.\n\nWhen tracing a typical tool call deployment, there are four distinct sources of records: the host's transcript, the model's request and arguments, the consent decision, and the server's own log. Each of these is written by a different party with distinct interests. The host's transcript, generated by the agent runtime, contains the full context of the request but is ultimately untrustworthy as standalone evidence. The MCP server's log, controlled by the server operator or vendor, is potentially under their jurisdiction and may not be shared in an incident.\n\nThe most authoritative record of a tool call's effects is the downstream system's logs, such as those for a repository, database, or ticketing API. However, the token passthrough section highlights a critical issue: unless the server authenticates correctly, this downstream log may incorrectly attribute the action to another source. This underscores the importance of proper authentication and logging mechanisms.\n\nIn summary, while the MCP specification provides guidance on logging certain aspects of tool calls, it lacks comprehensive requirements. The resulting logs may be incomplete, untrustworthy, or controlled by parties with conflicting interests. For effective accountability and auditing, a more robust logging framework must be implemented that captures the necessary information and ensures the integrity of the recorded evidence.",
  "summary": "The Model Context Protocol has become the default way an AI agent reaches a tool. That is convenient for the people wiring agents up and awkward for the people who later have to answer for what those agents did, because the protocol standardises the call and says almost nothing about the record . This piece goes through what the current spec actually asks you to log, where a tool call gets…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}