diff --git a/.github/upstream-projects.yaml b/.github/upstream-projects.yaml index d72c82e2..367e5936 100644 --- a/.github/upstream-projects.yaml +++ b/.github/upstream-projects.yaml @@ -44,7 +44,7 @@ projects: - id: toolhive repo: stacklok/toolhive - version: v0.40.0 + version: v0.40.1 # toolhive is a monorepo covering the CLI, the Kubernetes # operator, and the vMCP gateway. It also introduces cross- # cutting features that land in concepts/, integrations/, diff --git a/docs/toolhive/guides-k8s/logging.mdx b/docs/toolhive/guides-k8s/logging.mdx index cf5ce0b3..a1d798d8 100644 --- a/docs/toolhive/guides-k8s/logging.mdx +++ b/docs/toolhive/guides-k8s/logging.mdx @@ -200,15 +200,15 @@ configured, the `user_id` field is set to `local`. #### Key fields in audit logs -| Field | Description | -| --------------- | --------------------------------------------- | -| `audit_id` | Unique identifier for the audit event | -| `type` | Type of MCP operation (see event types below) | -| `outcome` | Result: `success` or `failure` | -| `component` | Name of the MCP server | -| `subjects.user` | User display name (from JWT claims) | -| `target.method` | MCP method called | -| `target.name` | Tool/resource name | +| Field | Description | +| --------------- | -------------------------------------------------------------------- | +| `audit_id` | Unique identifier for the audit event | +| `type` | Type of MCP operation (see event types below) | +| `outcome` | Result: `success`, `failure`, `error`, `denied`, `application_error` | +| `component` | Name of the MCP server | +| `subjects.user` | User display name (from JWT claims) | +| `target.method` | MCP method called | +| `target.name` | Tool/resource name | #### Common audit event types @@ -225,33 +225,33 @@ configured, the `user_id` field is set to `local`. #### Audit log fields -| Field | Type | Description | -| ---------------------------- | ------ | ----------------------------------------------------------------------- | -| `time` | string | Timestamp when the log was generated | -| `level` | string | Log level (`AUDIT` for audit events) | -| `msg` | string | Always "audit_event" for audit logs | -| `audit_id` | string | Unique identifier for the audit event | -| `type` | string | Type of MCP operation (see event types below) | -| `logged_at` | string | UTC timestamp of the event | -| `outcome` | string | Result of the operation: `success` or `failure` | -| `component` | string | Name of the MCP server | -| `source` | object | Request source information | -| `source.type` | string | Source type (e.g., "network") | -| `source.value` | string | Source identifier (e.g., IP address) | -| `source.extra` | object | Additional source metadata | -| `subjects` | object | User and identity information | -| `subjects.user` | string | User display name (from JWT claims: name, preferred_username, or email) | -| `subjects.user_id` | string | User identifier (from JWT sub claim) | -| `subjects.client_name` | string | Client application name (optional, from JWT claims) | -| `subjects.client_version` | string | Client version (optional, from JWT claims) | -| `target` | object | Target resource information | -| `target.endpoint` | string | API endpoint path | -| `target.method` | string | MCP method called | -| `target.name` | string | Tool or resource name | -| `target.type` | string | Target type (e.g., "tool") | -| `metadata` | object | Additional metadata | -| `metadata.extra.duration_ms` | number | Operation duration in milliseconds | -| `metadata.extra.transport` | string | Transport protocol used | +| Field | Type | Description | +| ---------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `time` | string | Timestamp when the log was generated | +| `level` | string | Log level (`AUDIT` for audit events) | +| `msg` | string | Always "audit_event" for audit logs | +| `audit_id` | string | Unique identifier for the audit event | +| `type` | string | Type of MCP operation (see event types below) | +| `logged_at` | string | UTC timestamp of the event | +| `outcome` | string | Result of the operation: `success`, `failure`, `error`, `denied` (authorization denial), or `application_error` (transport succeeded but the JSON-RPC response reported an error) | +| `component` | string | Name of the MCP server | +| `source` | object | Request source information | +| `source.type` | string | Source type (e.g., "network") | +| `source.value` | string | Source identifier (e.g., IP address) | +| `source.extra` | object | Additional source metadata | +| `subjects` | object | User and identity information | +| `subjects.user` | string | User display name (from JWT claims: name, preferred_username, or email) | +| `subjects.user_id` | string | User identifier (from JWT sub claim) | +| `subjects.client_name` | string | Client application name (optional, from JWT claims) | +| `subjects.client_version` | string | Client version (optional, from JWT claims) | +| `target` | object | Target resource information | +| `target.endpoint` | string | API endpoint path | +| `target.method` | string | MCP method called | +| `target.name` | string | Tool or resource name | +| `target.type` | string | Target type (e.g., "tool") | +| `metadata` | object | Additional metadata | +| `metadata.extra.duration_ms` | number | Operation duration in milliseconds | +| `metadata.extra.transport` | string | Transport protocol used | #### Audit event types diff --git a/docs/toolhive/guides-vmcp/audit-logging.mdx b/docs/toolhive/guides-vmcp/audit-logging.mdx index de7662f8..5d67491a 100644 --- a/docs/toolhive/guides-vmcp/audit-logging.mdx +++ b/docs/toolhive/guides-vmcp/audit-logging.mdx @@ -217,21 +217,21 @@ Each audit event is a structured JSON object with these fields: ### Field descriptions -| Field | Description | -| ----------- | --------------------------------------------------------- | -| `time` | Timestamp when the log was generated | -| `level` | Log level (`AUDIT` for audit events) | -| `msg` | Always "audit_event" for audit logs | -| `audit_id` | Unique identifier for this audit event | -| `type` | Event classification (what happened) | -| `logged_at` | UTC timestamp when the event occurred | -| `outcome` | Result (success, failure, denied, error) | -| `component` | System component that generated the event | -| `source` | Request origin (IP address, user agent) | -| `subjects` | Identity information (user, client) | -| `target` | Resource or operation targeted | -| `metadata` | Additional context (duration_ms, transport, backend_name) | -| `data` | Optional request and response payloads | +| Field | Description | +| ----------- | --------------------------------------------------------------------- | +| `time` | Timestamp when the log was generated | +| `level` | Log level (`AUDIT` for audit events) | +| `msg` | Always "audit_event" for audit logs | +| `audit_id` | Unique identifier for this audit event | +| `type` | Event classification (what happened) | +| `logged_at` | UTC timestamp when the event occurred | +| `outcome` | Result (`success`, `failure`, `error`, `denied`, `application_error`) | +| `component` | System component that generated the event | +| `source` | Request origin (IP address, user agent) | +| `subjects` | Identity information (user, client) | +| `target` | Resource or operation targeted | +| `metadata` | Additional context (duration_ms, transport, backend_name) | +| `data` | Optional request and response payloads | :::note[Audit events use a custom log level]