Sign in
MCP / Monitoring & logs

Monitoring & logs

Every MCP tool call lands in the same audit trail as your REST traffic — inspectable from the portal with a single filter toggle.

Same credentials, same logs, same dashboard. MCP reuses your existing OAuth2 client credentials. The client_id you already use for /api/v1/orders also signs /api/v1/mcp tool calls — both surfaces write to the same audit_events table. You do not need to create or remove a separate credential for MCP when an app is created or retired.

Where to find your logs

  1. Sign in to the developer portal.
  2. Open API Logs from the sidebar.
  3. Use the REST · MCP · All tab strip to scope the table to one protocol or the other.
  4. Filter further by method, status (2xx/4xx/5xx), env (Sandbox/Production), and keyword.
  5. Click any row to open the request detail modal — request id, full headers, body (masked where sensitive), and exact tool invocation arguments for MCP rows.

What MCP rows look like

The dashboard lists REST and MCP calls side by side in the same feed. Each row is tagged with a Type badge — REST rows surface the HTTP method and path, MCP rows surface the invoked tool name in its place. Everything else (time, env, app, status, duration) is identical to your existing REST logs.

REST POST /api/v1/orders/branded-cards 200
14:02:11 sandbox My Slack bot 238 ms
MCP giftronaut_get_balance 200
14:02:34 sandbox Claude Desktop (DCR) 54 ms
MCP giftronaut_create_branded_card_order 200
14:02:39 sandbox Claude Desktop (DCR) 412 ms

Mock preview — your live logs are at /logs with the MCP tab selected.

What gets recorded

Each MCP call writes one row to audit_events with these MCP-specific columns:

ColumnValueNotes
event_typeMCP_TOOL_CALLvs. API_CALL for REST
mcp_tool_namee.g. giftronaut_create_branded_card_orderFilterable in the dashboard
mcp_session_ide.g. sess_abc123…Groups tool calls within one MCP session
client_idThe OAuth2 client_idIdentical to REST client_id
envsandbox or prodFrom the JWT env claim
status · duration_msHTTP status + latencySame shape as REST rows
Field-level masking · Tool inputs use a fail-secure whitelist — only declared fields are stored in plaintext; everything else is replaced with ****. Tool outputs are hashed before being saved to the log, so secrets returned by create_api_credential are never stored in readable form.

Real-time notifications

MCP tool calls produce the same events as the REST API, so you can subscribe via the Webhook system to receive real-time notifications in your own systems (Slack, email, custom HTTP endpoints). For example, when an MCP order is delivered or bounces, or when balance falls below your low-balance threshold, the matching webhook event fires — exactly the same as if the order were placed via REST.

See Webhooks for the full event catalog and setup instructions.