← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Audit log for MCP servers

A server built on the Model Context Protocol can be called by any compliant client: Claude, another agent framework, a script. That is exactly why the server is the right place to keep the audit log, rather than each client — the server is the one point every call is guaranteed to pass through, regardless of who is asking.

What to record

Where to hook in

MCP servers built with the official SDKs register a handler for tool-call requests — typically the function you register to serve CallTool requests. There is no dedicated Vetro adapter for MCP today, so the pattern is the same duck-typed approach used everywhere else, applied directly with @vetro/core's Run API, at your own handler rather than a framework callback:

import { Vetro } from '@vetro/core';

const run = vetro.startRun({ name: 'my-mcp-server' });

async function handleCallTool(request) {
  const { name, arguments: input } = request.params;
  run.toolCall(name, input);
  try {
    const result = await runRealTool(name, input);
    run.toolResult(name, result);
    return result;
  } catch (err) {
    run.error(err, { tool: name });
    throw err;
  }
}

run.guard('tool.call', { name, input }) (or a direct @vetro/policy evaluate() call, as shown in the Claude Code hooks guide) runs before runRealTool executes, so a policy block stops the call before it does anything, not after.

One server, many runs

Unlike a single agent process, an MCP server may serve many concurrent sessions. Keep the mapping from ledger to session explicit — a meta field on startRun() with the session or connection id — so a reviewer can reconstruct which client asked for what, matching the traceability point in audit trail for AI agents.

What this does not replace

Recording at the server sees every call, but not what the client told the model beforehand, or why the model chose to call a given tool. Pair it with logging on the client side (see the guide for whichever framework drives your client) if that context matters for your use case.

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. For something to hand to an auditor, Vetro Attest issues a 49 USD counter-signed report mapping the evidence to EU AI Act articles.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.

Pricing