audit_log

What audit_log does on AirMCP

AI agents call audit_log to retrieve information from AirMCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why audit_log is rated Low

This is a Read operation—it retrieves data from an audit log without modifying, deleting, or executing anything. However, severity is elevated to 'high' because an audit log typically contains a complete history of sensitive tool invocations (arguments, timestamps, user identity), and unrestricted access by an AI agent could expose the full record of past actions including credentials, PII, or evidence of prior…

From the tool's definition Tool queries the on-device audit log by reading JSONL rows from ~/.airmcp/audit.jsonl and rotated files. The verb 'Query' and 'Reads' confirm read-only retrieval with no mutation.

The rule that runs audit_log safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AirMCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For audit_log, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "audit_log": {}
  }
}

Questions about audit_log