diff --git a/docusaurus/docs/cms/features/audit-logs.md b/docusaurus/docs/cms/features/audit-logs.md index ec25c8d07e..a307ce542a 100644 --- a/docusaurus/docs/cms/features/audit-logs.md +++ b/docusaurus/docs/cms/features/audit-logs.md @@ -8,6 +8,7 @@ tags: - audit logs - admin panel - Enterprise feature +- MCP - payload - features --- @@ -60,6 +61,8 @@ For each log item, the following information is displayed: - User: user who performed the action. - Details: displays a modal with more details about the action (e.g. the User IP address, the request body, or the response body). +With Strapi logged actions can come from the admin panel or from the [MCP server](/cms/features/strapi-mcp-server). Entry actions performed through the MCP server are logged like their admin panel equivalents. Actions that only read content are not logged. + ### Filtering logs @@ -88,3 +91,5 @@ For any log item, click the icon to access a modal with more dark: '/img/assets/settings/settings_log-details_DARK.png', }} /> + +With Strapi , in the payload, the `origin` key indicates where the action came from: `mcp` for the [MCP server](/cms/features/strapi-mcp-server), or `admin` for the admin panel. diff --git a/docusaurus/docs/cms/features/strapi-mcp-server.md b/docusaurus/docs/cms/features/strapi-mcp-server.md index 022282379d..a28b52f446 100644 --- a/docusaurus/docs/cms/features/strapi-mcp-server.md +++ b/docusaurus/docs/cms/features/strapi-mcp-server.md @@ -6,6 +6,7 @@ tags: - features - ai - MCP + - audit logs - content management toc_max_heading_level: 4 --- @@ -348,6 +349,12 @@ This means you can create tokens with fine-grained access: Create dedicated Admin tokens for each AI client or use case. Use the most restrictive permissions that still allow the AI to accomplish its task. ::: +### Audit logs + + + +Entry actions performed through the MCP server are recorded in the [Audit Logs](/cms/features/audit-logs). Each log payload carries an `origin` key set to `mcp`, which distinguishes actions triggered by an AI client from actions performed in the admin panel. Operations that only read content are not recorded. + ### Stateless architecture The MCP server uses a stateless architecture. Each POST request to the `/mcp` endpoint creates a fresh, ephemeral MCP server instance scoped to the authenticated token's permissions. There is no session persistence between requests: every request is independently authenticated and authorized. Because there is no session state, the AI client does not need to manage session IDs, and permission changes (such as revoking a token or updating its permissions) take effect on the next request.