Class McpAuditSinks

java.lang.Object
com.mcpdbwizard.pub.McpAuditSinks
public final class McpAuditSinks extends Object
Chooses and builds the McpAuditSink a generated server uses.
Environment
MCP_AUDIT_SINK Fully-qualified class name of an McpAuditSink to send records OFF this machine. Unset means records stay here.
MCP_AUDIT_FILE_DIR Where the local trail is kept. See FileAuditSink.
MCP_AUDIT_RETENTION_DAYS How long the local trail is kept. 0 keeps nothing.
MCP_AUDIT_LEVEL names (default) or values. See below.
MCP_AUDIT_MAX_BYTES Cap on the recorded response, default 8192. 0 means no cap.

names is the default deliberately. Argument values and response bodies are production data chosen by a model, so recording them turns the sink into a store with retention, encryption and erasure obligations. A default install must not begin exporting personal data because someone switched auditing on. Copyright 2003-2026 ATB Consultancy Services Ltd (formerly Orinda Software Ltd, Dublin, Ireland)

  • Field Details

  • Method Details

    • setting

      public static String setting(String theVariable)
      One audit setting, from the environment or a system property.

      The environment WINS. A deployment that pins a value in its compose file or its container spec must not be silently overridden from a web page — otherwise the file an operator reads to learn where production data goes becomes a lie. The system property is the fallback, and exists so the web application can set what its own deployment left open: the audit sink is built inside that process, and a process cannot change its own environment.

      The property spelling is the variable lower-cased with underscores as dots, matching the DAO_POOL_* / -Ddao.pool.* pairing the generated pool already uses.

      An environment value that is present but BLANK counts as unset, so a compose file can list every variable for documentation without thereby pinning them all.

    • propertyNameFor

      public static String propertyNameFor(String theVariable)
      The system-property spelling of an audit environment variable.

    • isFixedByEnvironment

      public static boolean isFixedByEnvironment(String theVariable)
      True when the environment pins this setting, so a UI must not offer to change it.

    • noOp

      public static McpAuditSink noOp()
      A sink that discards everything, used when none is configured.

    • isConfigured

      public static boolean isConfigured()
      Whether anything at all is recording — a local trail, a remote sink, or both.

      Widened on 2026-08-19, when the local trail arrived. It used to ask only whether SINK_VARIABLE named a class, and its callers use it to decide whether to install a shutdown hook and whether to tell an operator that auditing is on. Left as it was, a deployment with a local trail and no remote sink would have had a sink that was never closed and a status page saying it was not auditing.

    • isStreamConfigured

      public static boolean isStreamConfigured()
      Whether SINK_VARIABLE names a sink to send records off this machine.

    • isLocalTrailConfigured

      public static boolean isLocalTrailConfigured()
      Whether a local trail is wanted: a directory is named and the window is not zero.

      Zero is a deliberate setting meaning "keep nothing here", not an absence.

    • fromEnvironment

      public static McpAuditSink fromEnvironment()
      Build the configured sink, or a no-op when none is named.
      Throws:
      IllegalArgumentException - if a sink is named but cannot be constructed — a mistyped class name must stop start-up rather than silently leave the server unaudited, which is the failure where an operator believes calls are being recorded and they are not

    • fromEnvironment

      public static McpAuditSink fromEnvironment(String theSpoolSubdirectory)
      As fromEnvironment(), but giving this process its own spool subdirectory.

      Only a process that shares a host with other audited processes needs this — in practice the web application, which records proxied requests while the generated servers it launched record their own tool calls. A spool tolerates exactly one writer; see SpoolingAuditSink.wrap(McpAuditSink, String).

      Parameters:
      theSpoolSubdirectory - a directory name under MCP_AUDIT_SPOOL_DIR, or null

    • fromEnvironment

      public static McpAuditSink fromEnvironment(String theSpoolSubdirectory, int theRetentionCeilingDays)
      As fromEnvironment(String), capping the local trail's window.

      See FileAuditSink.fromEnvironment(String, int) for why a caller would need to.

      Parameters:
      theRetentionCeilingDays - the largest local window to honour

    • level

      public static McpAuditSinks.Level level()
      The configured level, defaulting to names.

    • maxBytes

      public static int maxBytes()
      The configured response cap in bytes.