Audit log

What’s recorded today

• Public MCP tool calls are written to external_mcp_tool_calls.
• Each row records token id, user id, tool name, success flag, duration, and timestamp.
• Internal agent runs are persisted as agent_runs.
• Internal tool names are persisted as tool_calls.
• Prompt text, message content, file content, and attachment content are not written to the telemetry tables.

Accuracy note for the website

Don’t over-claim “including denied calls”

Do not claim that every denied call is currently written to the public MCP audit table. Auth failures, rate-limit denials, and method-level denials return HTTP errors before the public MCP tool handler runs.

Internal agent denied-tool attempts may appear as tool attempts in run telemetry depending on SDK stream behavior, but the current tool_calls write path does not populate outcome or denial_reason.

If the product needs “including denied calls” as a launch claim, add an explicit audit write in the auth, rate-limit, and permission-denial paths before publishing that line.