Skip to content

Commit cfbfe6c

Browse files
github-actions[bot]claude
github-actions[bot]
and
claude
committed
Correct audit outcome value lists for v0.40.1
The K8s logging guide claimed `outcome` was `success` or `failure`. toolhive/pkg/audit/event.go defines five values, all reachable in Kubernetes audit chains. #5872 also makes `denied` newly reachable on MCPServer and MCPRemoteProxy by moving audit ahead of authorization so Cedar denials no longer short-circuit before audit runs. The vMCP audit guide was missing `application_error`, which the shared auditor emits by default when a JSON-RPC response reports an error. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 parent 8c89c21 commit cfbfe6c

2 files changed

Lines changed: 51 additions & 51 deletions

File tree

‎docs/toolhive/guides-k8s/logging.mdx‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -200,15 +200,15 @@ configured, the `user_id` field is set to `local`.
200200

201201
#### Key fields in audit logs
202202

203-
| Field | Description |
204-
| --------------- | --------------------------------------------- |
205-
| `audit_id` | Unique identifier for the audit event |
206-
| `type` | Type of MCP operation (see event types below) |
207-
| `outcome` | Result: `success` or `failure` |
208-
| `component` | Name of the MCP server |
209-
| `subjects.user` | User display name (from JWT claims) |
210-
| `target.method` | MCP method called |
211-
| `target.name` | Tool/resource name |
203+
| Field | Description |
204+
| --------------- | -------------------------------------------------------------------- |
205+
| `audit_id` | Unique identifier for the audit event |
206+
| `type` | Type of MCP operation (see event types below) |
207+
| `outcome` | Result: `success`, `failure`, `error`, `denied`, `application_error` |
208+
| `component` | Name of the MCP server |
209+
| `subjects.user` | User display name (from JWT claims) |
210+
| `target.method` | MCP method called |
211+
| `target.name` | Tool/resource name |
212212

213213
#### Common audit event types
214214

@@ -225,33 +225,33 @@ configured, the `user_id` field is set to `local`.
225225

226226
#### Audit log fields
227227

228-
| Field | Type | Description |
229-
| ---------------------------- | ------ | ----------------------------------------------------------------------- |
230-
| `time` | string | Timestamp when the log was generated |
231-
| `level` | string | Log level (`AUDIT` for audit events) |
232-
| `msg` | string | Always "audit_event" for audit logs |
233-
| `audit_id` | string | Unique identifier for the audit event |
234-
| `type` | string | Type of MCP operation (see event types below) |
235-
| `logged_at` | string | UTC timestamp of the event |
236-
| `outcome` | string | Result of the operation: `success` or `failure` |
237-
| `component` | string | Name of the MCP server |
238-
| `source` | object | Request source information |
239-
| `source.type` | string | Source type (e.g., "network") |
240-
| `source.value` | string | Source identifier (e.g., IP address) |
241-
| `source.extra` | object | Additional source metadata |
242-
| `subjects` | object | User and identity information |
243-
| `subjects.user` | string | User display name (from JWT claims: name, preferred_username, or email) |
244-
| `subjects.user_id` | string | User identifier (from JWT sub claim) |
245-
| `subjects.client_name` | string | Client application name (optional, from JWT claims) |
246-
| `subjects.client_version` | string | Client version (optional, from JWT claims) |
247-
| `target` | object | Target resource information |
248-
| `target.endpoint` | string | API endpoint path |
249-
| `target.method` | string | MCP method called |
250-
| `target.name` | string | Tool or resource name |
251-
| `target.type` | string | Target type (e.g., "tool") |
252-
| `metadata` | object | Additional metadata |
253-
| `metadata.extra.duration_ms` | number | Operation duration in milliseconds |
254-
| `metadata.extra.transport` | string | Transport protocol used |
228+
| Field | Type | Description |
229+
| ---------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
230+
| `time` | string | Timestamp when the log was generated |
231+
| `level` | string | Log level (`AUDIT` for audit events) |
232+
| `msg` | string | Always "audit_event" for audit logs |
233+
| `audit_id` | string | Unique identifier for the audit event |
234+
| `type` | string | Type of MCP operation (see event types below) |
235+
| `logged_at` | string | UTC timestamp of the event |
236+
| `outcome` | string | Result of the operation: `success`, `failure`, `error`, `denied` (authorization denial), or `application_error` (transport succeeded but the JSON-RPC response reported an error) |
237+
| `component` | string | Name of the MCP server |
238+
| `source` | object | Request source information |
239+
| `source.type` | string | Source type (e.g., "network") |
240+
| `source.value` | string | Source identifier (e.g., IP address) |
241+
| `source.extra` | object | Additional source metadata |
242+
| `subjects` | object | User and identity information |
243+
| `subjects.user` | string | User display name (from JWT claims: name, preferred_username, or email) |
244+
| `subjects.user_id` | string | User identifier (from JWT sub claim) |
245+
| `subjects.client_name` | string | Client application name (optional, from JWT claims) |
246+
| `subjects.client_version` | string | Client version (optional, from JWT claims) |
247+
| `target` | object | Target resource information |
248+
| `target.endpoint` | string | API endpoint path |
249+
| `target.method` | string | MCP method called |
250+
| `target.name` | string | Tool or resource name |
251+
| `target.type` | string | Target type (e.g., "tool") |
252+
| `metadata` | object | Additional metadata |
253+
| `metadata.extra.duration_ms` | number | Operation duration in milliseconds |
254+
| `metadata.extra.transport` | string | Transport protocol used |
255255

256256
#### Audit event types
257257

‎docs/toolhive/guides-vmcp/audit-logging.mdx‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -217,21 +217,21 @@ Each audit event is a structured JSON object with these fields:
217217

218218
### Field descriptions
219219

220-
| Field | Description |
221-
| ----------- | --------------------------------------------------------- |
222-
| `time` | Timestamp when the log was generated |
223-
| `level` | Log level (`AUDIT` for audit events) |
224-
| `msg` | Always "audit_event" for audit logs |
225-
| `audit_id` | Unique identifier for this audit event |
226-
| `type` | Event classification (what happened) |
227-
| `logged_at` | UTC timestamp when the event occurred |
228-
| `outcome` | Result (success, failure, denied, error) |
229-
| `component` | System component that generated the event |
230-
| `source` | Request origin (IP address, user agent) |
231-
| `subjects` | Identity information (user, client) |
232-
| `target` | Resource or operation targeted |
233-
| `metadata` | Additional context (duration_ms, transport, backend_name) |
234-
| `data` | Optional request and response payloads |
220+
| Field | Description |
221+
| ----------- | --------------------------------------------------------------------- |
222+
| `time` | Timestamp when the log was generated |
223+
| `level` | Log level (`AUDIT` for audit events) |
224+
| `msg` | Always "audit_event" for audit logs |
225+
| `audit_id` | Unique identifier for this audit event |
226+
| `type` | Event classification (what happened) |
227+
| `logged_at` | UTC timestamp when the event occurred |
228+
| `outcome` | Result (`success`, `failure`, `error`, `denied`, `application_error`) |
229+
| `component` | System component that generated the event |
230+
| `source` | Request origin (IP address, user agent) |
231+
| `subjects` | Identity information (user, client) |
232+
| `target` | Resource or operation targeted |
233+
| `metadata` | Additional context (duration_ms, transport, backend_name) |
234+
| `data` | Optional request and response payloads |
235235

236236
:::note[Audit events use a custom log level]
237237

0 commit comments

Comments
 (0)