Skip to main content
Server doesn’t provide adequate logging or monitoring capabilities.

​
How to resolve

  • Logging implementation: Implement comprehensive logging that captures all tool invocations including timestamps, caller identity, tool names, input parameters, return values, and execution outcomes. Follow MCP logging specifications if available and ensure logs are structured for easy parsing and analysis. Configure log retention policies that meet compliance requirements while balancing storage costs.
  • Monitoring implementation: Send logs to centralized logging infrastructure or SIEM (Security Information and Event Management) systems for correlation and analysis. Implement monitoring and alerting for suspicious patterns such as repeated failed authentication attempts, unusual tool access patterns, or high-frequency invocations. Ensure logs capture sufficient detail for forensic investigation while protecting sensitive data through appropriate redaction.
  • Log integrity: Implement log integrity protections to prevent tampering or manipulation.
  • Log auditing: Regularly review logs and conduct periodic audits to verify logging effectiveness and identify security issues.

​
Risk

Governance/Compliance Lack of observability vulnerabilities violate multiple security standards:
  • NIST Cybersecurity Framework 2.0 (DE.CM): Violates security continuous monitoring requirements by not providing visibility into MCP server operations and tool invocations.
  • OWASP MCP Top 10 (MCP08:2025 - Lack of Audit and Telemetry): Does not maintain audit trails or telemetry data needed to detect anomalous behavior and support incident response.
Security Without adequate logging and monitoring, security incidents involving MCP servers go undetected until significant damage has occurred. Lack of observability prevents identifying unauthorized access attempts, detecting malicious tool invocations, investigating data breaches, and understanding the scope of compromises. Organizations cannot perform effective incident response, forensic analysis, or root cause investigation without detailed audit trails. Additionally, the absence of monitoring makes it impossible to detect anomalous behavior patterns that could indicate prompt injection attacks, privilege escalation, or other exploitation attempts. This blind spot enables attackers to operate undetected for extended periods.

​
Explanation

The MCP server does not provide adequate logging, monitoring, or auditing capabilities to track tool invocations, identify callers, record parameters, and document outcomes. Without proper observability, security incidents cannot be detected, investigated, or remediated effectively. The scanner checks whether the server implements MCP logging specifications and verifies the presence and configuration of logging mechanisms.

​
Specifications

Trigger
  • MCP server scan detects that the server does not implement logging for tool invocations, lacks audit trails, or has insufficient monitoring capabilities.
Severity
  • LOW
Applies to: MCP Server