Class McpAuditEvent

java.lang.Object
com.mcpdbwizard.pub.McpAuditEvent
public final class McpAuditEvent extends Object
One auditable MCP tool call: what ran, how it ended, and — depending on the configured level — what went in and came back.

Truncation keeps integrity even when it loses content

A payload longer than the configured cap is cut, but the event still carries the full byte size and a SHA-256 of the whole payload, and sets a truncated flag. A clipped record is weak evidence on its own — "we logged the response, but not the part you are asking about" — so truncation here costs readability rather than integrity, and nobody can mistake a cut record for a complete one.

Values are not recorded by default

At McpAuditSinks.Level.NAMES only argument names appear, which is what the diagnostic McpCallRecord line has always done. Recording values makes this object carry production data, and the retention, encryption and erasure obligations that come with it. That is a deliberate decision for the deployment to take, not a default. Copyright 2003-2026 ATB Consultancy Services Ltd (formerly Orinda Software Ltd, Dublin, Ireland)

  • Field Details

  • Method Details

    • ofAccess

      public static McpAuditEvent ofAccess(String theUserValue, String theConfigValue, String theOperationValue, String theToolNameValue, String theOutcomeValue, int theStatusValue, long theDurationValue)
      Build the record for one request through the MCP proxy.

      No arguments and no response: those belong to the tool call itself and the generated server records them. This half answers who asked, for what, and whether they were allowed.

      Parameters:
      theUserValue - the authenticated account, or null when the request had none
      theConfigValue - the config named in the path
      theOperationValue - the JSON-RPC method, or the HTTP method when there is no body
      theToolNameValue - the tool named by a tools/call, otherwise null
      theStatusValue - the HTTP status returned to the caller

    • ofAdmin

      public static McpAuditEvent ofAdmin(String theActor, String theOperation, String theTargetValue, String theOutcomeValue, String theSourceValue)
      Build an administrative record: who did what, to what.

      These matter at least as much as the sign-in records beside them. An account created, a role granted or an access-matrix row changed alters WHO CAN REACH WHAT, and a config decides which database objects are reachable at all — curation here is enforced by absence from the generated binary, so changing a config changes the reachable surface. None of it was recorded anywhere before.

      Parameters:
      theActor - the signed-in account performing the action
      theOperation - one of the OP_ constants above
      theTargetValue - what was acted on: an account name, a config name, or null
      theOutcomeValue - ok or OUTCOME_DENIED
      theSourceValue - the remote address, or null

    • ofAuth

      public static McpAuditEvent ofAuth(String theUserValue, String theOperationValue, String theOutcomeValue, String theSourceValue, String theReasonValue)
      Build an authentication record.

      Answers the question the tool-call records cannot: when an account signed in, from where, and how many times it failed first. A run of failures is often the only trace an attack leaves, which is why OP_LOGIN_FAILED is recorded at least as carefully as a success.

      Nothing derived from the submitted credential may be passed here. theReason is a fixed vocabulary chosen by the caller from the authentication exception's TYPE, never its message and never the failed Authentication object, which in Spring Security can still hold the password that was tried.

      Parameters:
      theUserValue - the account name as submitted; may be an attacker's invention, so it is recorded as given and never trusted as an identity
      theOperationValue - OP_LOGIN, OP_LOGIN_FAILED or OP_LOGOUT
      theOutcomeValue - ok or OUTCOME_DENIED
      theSourceValue - the remote address, or null when it cannot be determined
      theReasonValue - why it was refused, from the fixed vocabulary; null on success

    • ofRawJson

      public static McpAuditEvent ofRawJson(String theRawJsonValue)
      Wrap an already-serialised record, for replay from a spool.
      Parameters:
      theRawJsonValue - the exact line that was written to disk

    • of

      public static McpAuditEvent of(String theToolNameValue, Map<String,Object> theArgumentsValue, String theOutcomeValue, long theDurationValue, String theResponseValue, McpAuditSinks.Level theLevel, int theMaxBytes)
      Build an event, applying the level and the truncation cap.
      Parameters:
      theArgumentsValue - the call's arguments; only the keys are used below McpAuditSinks.Level.VALUES
      theResponseValue - the response payload, or null
      theMaxBytes - cap for the recorded response, or 0 for no cap

    • getId

      public String getId()
      Unique per call.

      Present because spooled delivery is at-least-once: a crash between delivering a segment and deleting it replays that segment, so a consumer sees the record twice. Without an identity there is no way to collapse the duplicate, which would make the guarantee unusable rather than merely imperfect.

    • getTimestampMillis

      public long getTimestampMillis()

    • getToolName

      public String getToolName()

    • getOutcome

      public String getOutcome()

    • getDurationMillis

      public long getDurationMillis()

    • getArguments

      public Map<String,Object> getArguments()

    • getResponse

      public String getResponse()

    • isResponseTruncated

      public boolean isResponseTruncated()

    • getUser

      public String getUser()
      The authenticated account, or null — always null on an event a generated server built.

    • getConfig

      public String getConfig()
      The config the request named, or null.

    • getOperation

      public String getOperation()
      The JSON-RPC method, or the HTTP method when the request had no body. Null when unknown.

    • getStatus

      public int getStatus()
      The HTTP status returned to the caller, or 0 when this was not a proxied request.

    • toJson

      public String toJson()
      The event as JSON — the payload a sink writes.

      An extension of McpCallRecord's shape rather than a second format, so a log line and a queue message describe the same call the same way.

    • getTarget

      public String getTarget()
      What an administrative action acted on, or null.

    • getSource

      public String getSource()
      Where the authentication attempt came from, or null.

    • getReason

      public String getReason()
      Why an authentication attempt was refused, from the fixed vocabulary, or null.