Otto Support - Logging and Visibility in MCP Servers

2026-05-14 · Source: Bishop Fox - Bishopfox.com · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Intermediate, medium

Summary

The "otto-support" tool, designed for Model Context Protocol (MCP) servers, highlights critical logging and visibility gaps by providing both a minimal and a comprehensive audit log for comparison. This demonstration follows a series on five attack classes, including SSRF and prompt injection, which often leave no distinct traces in standard MCP logs. A 2026 industry survey revealed 88% of organizations experienced AI agent security incidents, yet only 24.4% had full visibility. The EchoLeak case (CVE-2025-32711, CVSS 9.3) in June 2025 exemplified this, where Microsoft 365 Copilot exfiltrated data, but logs appeared routine. The EU AI Act, effective August 2026, will mandate structured audit trails for high-risk AI systems, making robust MCP logging a compliance necessity. The article contrasts "minimal.log" with "audit.log" in "otto-support", showing how detailed logs capture internal calls, destination types, and response digests, crucial for incident response. It also notes remaining blind spots like debug tool logs and plaintext password files.

Key takeaway

For MLOps Engineers or AI Architects deploying Model Context Protocol (MCP) servers, you must prioritize implementing comprehensive, structured audit logging. Standard access logs are inadequate for detecting sophisticated agent-based attacks like SSRF or prompt injection, as demonstrated by CVE-2025-32711. Ensure your logging captures full tool invocation context, outbound request details, and response content, shipping these to a centralized SIEM. This proactive approach is crucial for incident response, compliance with upcoming regulations like the EU AI Act, and mitigating the significant "confidence-visibility gap" in AI agent security.

Key insights

MCP server security critically depends on comprehensive, structured logging to detect sophisticated agent-based attacks and meet regulatory demands.

Principles

• Standard MCP logging is insufficient for detecting agent attacks.
• Regulatory compliance will soon mandate AI agent audit trails.
• Assume mitigation is incomplete; robust logging enables response.

Method

Implement structured audit logging via request hooks and tool middleware, capturing full context including outbound request details, destination class, and response content classification. Ship logs to a centralized SIEM.

In practice

• Run MCP servers in containers without host mounts.
• Purge conversation history and session logs regularly.
• Configure SIEM alerts for loopback destinations or credential-shaped responses.

Topics

• Model Context Protocol
• AI Agent Security
• Structured Logging
• EU AI Act
• CVE-2025-32711
• Incident Response

Best for: AI Security Engineer, MLOps Engineer, AI Architect

Related on AIssential

• How can enterprises govern MCP connections at scale? — MCP connections, enabling autonomous agent actions, demand robust governance to mitigate significant enterprise risks.
• AI Governance in Production: Ship Safe, Pass Audits — Bridging the gap between MLOps production data and regulatory audit evidence is crucial for AI Act and ISO 42001 compliance.
• Why AI Agent Observability Requires More Than Tool Call Logging — Agent failures often stem from internal reasoning, not tool execution, requiring observability beyond tool call logging.
• How to build a local MCP registry your security team will actually approve — Ungoverned MCP deployments pose significant audit and breach risks; a well-governed registry transforms MCP into an enterprise capability.
• AI Request Logs Are the Memory of a Multi-Model Product — AI request logs are the indispensable memory for diagnosing, optimizing, and managing complex multi-model AI product behavior.
• How Smartsheet built a remote MCP server on AWS — Smartsheet's AWS-hosted MCP server provides AI agents structured, token-optimized access to enterprise data, ensuring reliability and cost efficiency.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Bishop Fox - Bishopfox.com.