Notifications
Clear all
Topic starter
11/08/2026 3:19 pm
TL;DR: MCP servers often expose only minimal access logs, leaving tool arguments, downstream calls, and authorization context invisible even when agents reach sensitive internal endpoints, according to Bishop Fox. That observability gap turns incident response and EU AI Act traceability into guesswork, not governance.
NHIMG editorial — based on content published by Bishop Fox: MCP server logging and visibility gaps in the otto-support series
By the numbers:
- A 2026 industry survey of AI agent security, covering 919 organizations across regulated industries, found that 88% confirmed or suspected security incidents involving AI agents.
- Only 24.4% reported full visibility into agent interactions, and only 47.1% of deployed agents are actively monitored or secured.
- 82% of executives feel confident their existing policies protect against unauthorized agent actions, but only 21% have complete visibility into agent permissions, tool usage, or data access patterns.
Questions worth separating out
Q: How should teams log MCP server activity for security investigations?
A: Teams should log every tool invocation as a structured security event, not a text line.
Q: Why do minimal MCP logs create a governance problem?
A: Minimal logs create a governance problem because they prove only that a tool was called, not what it reached or what data left the server.
Q: What breaks when MCP servers do not record outbound destinations?
A: When outbound destinations are not recorded, SSRF, internal metadata access, and ordinary fetches can look identical.
Practitioner guidance
- Implement structured audit logging for every tool call Capture tool name, arguments, authorization context, destination class, response status, and response digest in a machine-readable format before forwarding to a SIEM.
- Classify outbound requests before they leave the server Record resolved IP, hostname, and whether the target is loopback, private, or public so internal metadata access and suspicious egress can be separated quickly.
- Move MCP servers into isolated runtimes Use containers with no host mounts or dedicated virtual machines so the server cannot read ~/.claude/, ~/.codex/, ~/.ssh, or other local identity material.
What's in the full article
Bishop Fox's full post covers the operational detail this post intentionally leaves for the source:
- Side-by-side minimal and audit log examples showing exactly what each attack class leaves behind
- Command-level walkthroughs of the otto-support CTF environment and how the logs behave in practice
- Verbose log fields such as outbound host, response digest, and forward_auth state that support investigation
- Mitigations for structured logging, SIEM forwarding, and container isolation in an MCP deployment
👉 Read Bishop Fox's MCP logging analysis for AI agent visibility gaps →
MCP observability gaps: what security teams are missing?
Explore further
11/08/2026 3:30 pm
Logging without context is not governance, it is residue. Minimal MCP logs preserve the fact that a tool was called, but not the identity context, parameters, destination, or downstream effect needed for control. That leaves IAM, PAM, and incident response teams unable to prove whether an agent or server acted within its intended boundary. The practical conclusion is that shallow logging is operationally convenient but analytically empty.
A few things that frame the scale:
- 88% confirmed or suspected security incidents involving AI agents across a 919-organisation survey, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable for MCP traceability under AI governance requirements?
A: The organisation running the system is accountable for ensuring tool invocations, inputs, and outcomes can be reconstructed. If the deployment supports higher-risk AI use cases, traceability sits inside the control environment, not outside it, so security, platform, and compliance teams share responsibility for the audit trail.
👉 Read our full editorial: MCP server logging gaps leave AI agent activity invisible
