Audit log
Every tool call and every gateway connection event in your organization is logged. The Audit page is where you search them.
What gets logged
- Tool call — every tool call: who called what, with which arguments, what came back, how long it took, and whether the call was allowed or denied by your role policies.
- Connection — when a team member's AI client connects or disconnects from the gateway.
Denied tool calls are logged too — the policy check happens before the call is forwarded, and the deny reason is recorded.
Searching the log
The page shows the most recent entries first, capped at 100 per view. Filter using the controls at the top of the page:
- User — autocompleted from identities seen in the log. Shows only entries triggered by that member. Calls made with a service token appear here as
svc:<name>(e.g.svc:ci-bot) and can be filtered the same way. - MCP — autocompleted from upstream MCP IDs. Shows only entries against that upstream.
- Tool — free-text. Substring match against the full tool name (e.g. typing
querymatchesmixpanel__query_eventsanddatabase__run_query). - Action — dropdown:
- All actions (default)
- Tool call — only tool calls
- Connection — connect and disconnect events together
Filters combine — they all have to match for an entry to appear.
The columns are: Time, Action, User, MCP, Tool / Details, Outcome, Latency. The Tool/Details column shows the full tool name for tool calls, or the AI client type (Claude, ChatGPT, etc.) for connection events.
Live updates
The play/pause button at the top-left of the filter bar controls live mode:
- Live (green, default) — new entries stream in as they happen via Server-Sent Events. Filters apply to incoming entries the same way they apply to existing ones.
- Paused — the view freezes. Useful for taking a snapshot, scrolling through what's there, or copy/pasting an entry without it scrolling away.
Clicking pause doesn't stop logging — it just stops the dashboard from showing new entries until you press play again.
Operator access
If you use the hosted MCP Hero, the people who operate the service have a limited support role that can step into your organization to help (for example, to investigate failing connections). That access is recorded, as are the reversible account actions an operator can take on your behalf. It can't read your secrets or your tool-call arguments. See Operator access for the full picture.