Skip to content

Document that MCP actions are recorded in audit logs #3380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pwizla wants to merge 2 commits into
base: main
Choose a base branch
from
+12 −0
Open

Document that MCP actions are recorded in audit logs #3380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2fa0c84
Document that MCP actions are recorded in audit logs
pwizla Aug 21, 2026
792ad08
Improve formatting (inline badge without tooltip)
pwizla Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docusaurus/docs/cms/features/audit-logs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ tags:
- audit logs
- admin panel
- Enterprise feature
- MCP
- payload
- features
---
Expand Down Expand Up @@ -60,6 +61,8 @@ For each log item, the following information is displayed:
- User: user who performed the action.
- Details: displays a modal with more details about the action (e.g. the User IP address, the request body, or the response body).

With Strapi <VersionBadge version="5.52.0+" noTooltip /> logged actions can come from the admin panel or from the [MCP server](/cms/features/strapi-mcp-server). Entry actions performed through the MCP server are logged like their admin panel equivalents. Actions that only read content are not logged.


### Filtering logs

Expand Down Expand Up @@ -88,3 +91,5 @@ For any log item, click the <Icon name="eye" /> icon to access a modal with more
dark: '/img/assets/settings/settings_log-details_DARK.png',
}}
/>

With Strapi <VersionBadge version="5.52.0" noTooltip />, in the payload, the `origin` key indicates where the action came from: `mcp` for the [MCP server](/cms/features/strapi-mcp-server), or `admin` for the admin panel.
7 changes: 7 additions & 0 deletions docusaurus/docs/cms/features/strapi-mcp-server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ tags:
- features
- ai
- MCP
- audit logs
- content management
toc_max_heading_level: 4
---
Expand Down Expand Up @@ -348,6 +349,12 @@ This means you can create tokens with fine-grained access:
Create dedicated Admin tokens for each AI client or use case. Use the most restrictive permissions that still allow the AI to accomplish its task.
:::

### Audit logs

<EnterpriseBadge /> <VersionBadge version="5.52.0" />

Entry actions performed through the MCP server are recorded in the [Audit Logs](/cms/features/audit-logs). Each log payload carries an `origin` key set to `mcp`, which distinguishes actions triggered by an AI client from actions performed in the admin panel. Operations that only read content are not recorded.

### Stateless architecture

The MCP server uses a stateless architecture. Each POST request to the `/mcp` endpoint creates a fresh, ephemeral MCP server instance scoped to the authenticated token's permissions. There is no session persistence between requests: every request is independently authenticated and authorized. Because there is no session state, the AI client does not need to manage session IDs, and permission changes (such as revoking a token or updating its permissions) take effect on the next request.
Expand Down
Loading