MCP Audit

What P4ST4S/mcp-audit MCP server does

The P4ST4S/mcp-audit MCP server is a transparent proxy rather than a domain-specific MCP tool provider. It receives MCP JSON-RPC traffic from a client, forwards that traffic to an upstream server, and records the exchange for review. The proxy covers tool calls, resource reads, prompt requests, and other JSON-RPC methods.

Audit records can be stored as JSONL files or in SQLite. Entries can be signed with HMAC-SHA256 when a secret is configured. Sensitive values can be removed from stored requests and responses using case-insensitive JSON key fragments. The proxy can also enforce allow or deny rules for tools/call requests and apply token-bucket limits per client and tool.

A local read-only dashboard is available by default on port 9090, while Prometheus metrics are exposed on port 9091. These interfaces provide local operational visibility alongside the audit storage.

How it works

Place the P4ST4S/mcp-audit MCP server between the MCP client and the upstream server. In stdio mode, it starts the configured upstream command and communicates with the client over local standard input and output. In HTTP mode, it listens on its configured port and forwards requests to an HTTP upstream URL.

The proxy preserves MCP protocol traffic while applying middleware during forwarding. Rate limiting is enabled by default at 60 requests per minute for each client-and-tool pair. Redaction is also enabled by default. Policy checks are disabled by default, and retries are disabled by default; when enabled, retries are limited to conservative, idempotent HTTP JSON-RPC methods, and tools/call is not retried.

HTTP deployments can specify a custom CA bundle, TLS server-name override, or client certificate and key for mutual TLS. Request headers are stripped by default, with selected headers such as Authorization available through configuration when the upstream requires them.

Setup and configuration

Install a release binary, use the published container image, or build from source with Go. The repository documents the following source installation command:

go install github.com/P4ST4S/mcp-audit/cmd/mcp-audit@latest

A typical local setup supplies an AUDIT_SECRET and starts stdio mode with an upstream command. HTTP mode accepts an upstream URL and can expose the dashboard and metrics endpoints using their default ports. Docker Compose is also documented as an option.

By default, configuration is loaded from config.yaml in the current directory. Command-line flags take precedence over file values, and AUDIT_SECRET takes precedence over audit.secret. Important settings include the transport, upstream, audit backend and paths, signing behavior, redaction patterns, policy rules, rate limits, rotation, and asynchronous audit buffering.

Tools and capabilities

The P4ST4S/mcp-audit MCP server does not add domain-specific tools. Its capabilities are proxy and operational controls:

• Forward MCP traffic over stdio or HTTP.
• Write audit data to JSONL or SQLite.
• Sign audit entries with HMAC-SHA256 when configured.
• Redact sensitive JSON fields before storage.
• Apply allow or deny rules to tool calls.
• Limit requests per client and tool.
• Rotate JSONL archives by size or time and retain them by count or age.
• Serve a read-only dashboard and Prometheus metrics.

Limitations and notes

The proxy does not replace or modify the upstream MCP server, and directories may display upstream tools rather than capabilities implemented by the proxy itself. HTTP retry behavior is intentionally narrow and does not retry tool calls. TLS certificate verification can be disabled for local testing, but that setting is not suitable as a general production configuration. The dashboard and metrics endpoints use local default addresses and ports unless changed by the deployment configuration.