Audit Trail

Secure Your Audit Trail

Value Proposition Support compliance and data governance with detailed audit tracking. Capture pre-mutation snapshots to maintain visibility into agent actions, balancing AI autonomy with organizational security requirements.

⚙️ Automate Compliance & Governance

Deliver strict data governance and streamline compliance workflows with our robust, automated audit tracking. Ensure complete operational visibility across all AI database interactions by capturing granular pre-mutation snapshots, seamlessly bridging AI autonomy with rigorous organizational security requirements.

Configure by passing the following flags during server initialization:

• --audit-log <path>: Enables the audit log and specifies the file path (e.g., --audit-log logs/mcp-audit.jsonl, Env: AUDIT_LOG).
• --audit-backup: Enables pre-mutation snapshots for DML changes (Env: AUDIT_BACKUP).
• --audit-reads: Includes read-scope tool calls (like SELECTs) in the audit log (Env: AUDIT_READS).
• --audit-redact: Automatically redacts sensitive parameters from the JSONL output (Env: AUDIT_REDACT).
• --audit-log-max-size: Maximum size for the audit log file. Reaching this maximum triggers automatic log rotation (default: 10MB, Env: AUDIT_LOG_MAX_SIZE).
• --audit-backup-data: Includes the original row data in pre-mutation snapshots (Env: AUDIT_BACKUP_DATA).
• --audit-backup-max-size: Maximum table size in bytes for data capture (default: 50MB, Env: AUDIT_BACKUP_MAX_SIZE).

See the Configuration guide for all audit options, including size limits and the redaction toggle.

Exporter Container Integration (mysql-mcp-exporter / writenotenow/mysql-mcp)

When running the Prometheus metrics exporter in Docker (using the local mysql-mcp-exporter build or the remote writenotenow/mysql-mcp image), the container reads the IDE's audit log via a separate environment variable:

Variable	Value	Purpose
AUDIT_LOG_PATH	/var/log/mysql-mcp/mcp-audit.jsonl	Read-only path to the IDE's live audit JSONL, mounted from ../../logs

This separates the read path (metrics aggregation) from the write path (--audit-log for the exporter's own AuditLogger), preventing log rotation race conditions.

Note

V8 isolate internal data mutations (Code Mode) are not captured by the audit log; only database queries executed from the isolate are logged.

• Resources — mysql://audit resource details
• Code Mode — Native V8 isolate
• Tools — Full tool list with scope groups
• Configuration — Configuration options