What is Log Forwarding?
Log forwarding is the practice of sending audit logs from the MCP proxy to external logging systems — such as SIEM platforms, S3 buckets, or Elasticsearch clusters — for centralised analysis, correlation, and long-term storage.
WHY IT MATTERS
An MCP proxy generates valuable security data — every tool call, every policy decision, every denial. But that data is only useful if it reaches the systems where security teams can analyse it. A proxy running in isolation, logging to its own local storage, creates an information silo. Security teams can't correlate agent behaviour with other system events, compliance teams can't include agent logs in their audit reports, and incident responders can't search agent activity alongside application and infrastructure logs.
Log forwarding solves this by shipping proxy logs to centralised platforms in real time or near-real time. The most common destinations are SIEM systems (Splunk, Datadog, Elastic Security) for security monitoring, object storage (S3, GCS) for long-term retention, and log aggregation platforms (Elasticsearch, Loki) for search and analysis.
The forwarding mechanism matters. Reliable log forwarding must handle network interruptions (buffering logs locally when the destination is unavailable), ensure ordering (so events can be reconstructed chronologically), and support structured formats (JSON, CEF) so downstream systems can parse and index the data without custom transformations.
HOW POLICYLAYER USES THIS
PolicyLayer emits structured decision logs in JSON format, designed for forwarding to external systems. Logs can be sent to stdout for collection by container-native log agents (Fluentd, Vector, Filebeat), written to files for traditional log shippers, or sent directly to HTTP endpoints. The structured format includes all fields needed for downstream indexing — tool name, arguments, policy file, rule matched, decision, timestamp, and agent identity — so SIEM systems can create dashboards and alerts without custom parsing.