MCP log
A history of every AI assistant call to your data over the MCP connector: reads of reference data, prepared and executed changes, and requests the system rejected.
How to Access
Settings → MCP log (/settings/mcp-log).
Overview
Every call the AI assistant makes over MCP is recorded: which skill was called, in which phase (read, prepare, execute), how it ended (success, rejection, permission denial) and which record it touched. This lets you see exactly what the assistant did in your account.
Secrets are never stored: access tokens, passwords and confirmation tokens are never written to the log — only their safe short references. Call arguments are stored masked and truncated.
Scope
The log is available to the account owner and to employees with the “Administrator (Management mode)” interface. The owner sees activity for the whole account: all connected clients, including employees' connections. An administrator employee sees the calls of their own connections only. Other employees do not see the page in the menu.
The scope is shown by the badge at the top of the page.
Fields
| Field | Description |
|---|---|
| Time | When the call ran |
| Action | What the assistant did: "Item search", "New document", "Document posting". A dot next to it marks a database write |
| Target | The affected record in plain words: «Товар «Лагман»», "Goods receipt №00-000317". A dash means the call had no single record (a search, for example) |
| Phase | Read, Prepare, Execute or Skill catalogue |
| Outcome | Success, Rejected, No scope, No rights, Invalid params, Unknown skill, Rate limit or Error |
| Employee | For the owner's connections — “Account owner”. For an employee's connections — the full name of the employee the connection acted as |
| Client | Name of the connected assistant ("Claude") or the label you gave the connection |
The Details button expands the denial reason, the duration and the technical facts: exact skill name, required scope, short token references and the masked call arguments.
The Prepare phase is a proposal: the assistant showed what it intends to do, but nothing was written yet. Writing happens only in the Execute phase.
Filters
- Skill — exact skill name.
- Phase and Outcome — narrow by type and result.
- From / To — date range.
- Writes only — show only calls that actually wrote to the database.
Tips
- Start with the Writes only filter to quickly see every change the assistant made.
- An outcome of No rights or No scope means the assistant tried something the token is not allowed to do — the request was safely rejected.
- An outcome of Rate limit means the assistant was calling too often and this call was refused without running. Calls are accepted again within a minute.
FAQ
Q: Are passwords or tokens visible in the log?
A: No. Secrets are masked on the server and never written to the log — only safe short references for correlation.
Q: Why can't an employee see the log?
A: The account owner and employees with the “Administrator (Management mode)” interface can connect an AI assistant and view the MCP log. An employee with the “Manager” interface cannot connect an assistant, so there is no log for them. The owner sees every call for the account, including employees' connections.
Q: What does the “Rate limit” outcome mean?
A: The assistant's calls are limited per minute: per connection — 120 calls and 20 change confirmations; per account — 300 calls and 60 confirmations. A call over the limit is refused and not executed — nothing changes in the database. From the next minute calls are accepted again. If you see this outcome often, check the Client column to find which connection makes that many calls.
Q: How long are entries kept?
A: The log is periodically purged of old entries (on the order of a few months).