How to review MCP Access Activities
MCP Access Activities lists the Model Context Protocol: A standard protocol for AI agent and server interactions that defines how AI assistants communicate with external tools and data sources.Learn more(opens in new tab) requests that passed through the MCP Identity Gateway: A component that brokers MCP traffic between MCP clients and target MCP servers, validating authorization and presenting Aembit-managed credentials on each request.Learn more without an error or an exception code. Each row is an activity, a group of requests that all have the same user, MCP Client: An application (such as Claude Desktop, Claude Code, or Gemini CLI) that connects to MCP servers to access tools and resources on behalf of users.Learn more, MCP Server: A server that implements the Model Context Protocol to provide tools, resources, or data to AI agents and MCP clients.Learn more(opens in new tab), MCP method, and target. Requests that reached more than one MCP server share a Multiple row, whichever servers they reached.
MCP Access Activities also leaves out a request with an exception code of Warning severity.
To review those requests, use MCP Access Exceptions.
Only traffic from MCP Identity Gateway 1.35.6263 or later appears.
See MCP Identity Gateway supported versions.
What MCP Access Activities displays
Section titled “What MCP Access Activities displays”MCP Access Activities shows times in Coordinated Universal Time (UTC). MCP Access Activities shows requests in the Resource Set: Resource Sets are organizational containers that group Access Policy components together, enabling you to manage configurations across different environments, regions, or use cases.Learn more you’re working in.
| Column | Description |
|---|---|
| Last seen (UTC) | The time of the most recent request in the activity. |
| User | The user Aembit recorded for the request. |
| MCP client | The Client Workload: Client Workloads represent software applications, scripts, or automated processes that initiate access requests to Server Workloads, operating autonomously without direct user interaction.Learn more that represents the MCP client. |
| MCP server | The MCP server that the MCP Identity Gateway forwarded the request to. |
| MCP method | The MCP method the request called, such as tools/call or resources/read. |
| Target | The tool name, resource URI, prompt name, or task ID the method acted on. |
| Requests | The number of requests in the activity in the selected timespan. |
The table sorts by Last seen (UTC), newest first.
When Aembit has no single value for a column, the cell shows one of these values:
| Value | Column | Meaning |
|---|---|---|
| Multiple | MCP server | Each request reached more than one MCP server, and requests that reached different servers share the row. Hover to list them. |
| Not determined | MCP client, MCP server | Aembit recorded no MCP client or no MCP server for the request. |
| Not applicable | Target | Aembit recorded no tool name, resource URI, prompt name, or task ID for the request. |
| Unavailable | MCP method | Aembit recorded no MCP method for the request. |
| Unknown | User | Aembit recorded no user for the request. |
Review MCP Access Activities
Section titled “Review MCP Access Activities”Open the report and narrow it to the users, MCP clients, or MCP servers you’re investigating. Look for an unexpected MCP client, an MCP server a user shouldn’t reach, or a tool called more often than you expect.
-
Log into your Aembit Tenant: Aembit Tenants serve as isolated, dedicated environments within Aembit that provide complete separation of administrative domains and security configurations.Learn more.
-
Click Reporting in the left sidebar.
-
At the top, select Reporting ☰ MCP Access Activities.
By default, Aembit displays the activities from the last 24 hours. When you return to the report, it keeps the timespan and filters you last set. If no requests match, the table shows “No MCP activity found.”
-
To shorten the window, select a value from the Timespan filter.
-
To narrow the table, use one or more filters:
Filter Matches User Users whose recorded identifier contains the text you enter MCP Client MCP clients whose name contains the text you enter MCP Server MCP servers whose name contains the text you enter MCP Method The MCP methods you select from the list Target Targets that contain the text you enter -
To search the User, MCP client, MCP server, MCP method, Target, and Requests columns at once, enter text in the search box.
Review an activity’s requests
Section titled “Review an activity’s requests”Open an activity to see each request in it. For a request you select, Aembit shows the Access Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more decisions behind it and the events it produced.
-
Click a row in MCP Access Activities.
Aembit displays the Activity Detail page for that activity.
-
In Activity summary, review the activity’s values, including First seen and Last seen.
-
In Request history, find the request to review.
Each row is one request, with its Time (UTC) and HTTP response code. The count beside the heading is the total number of requests, across all pages.
-
Click View events on the request.
Aembit displays the sections for that request, described in the following table.
-
In Relevant events, click Open event to see an event’s raw JSON in the Event details panel.
After you select a request, the Activity Detail page shows these sections:
| Section | What it shows |
|---|---|
| Access decisions | Each Access Policy decision for the request, with its Boundary, Access Policy, and Decision |
| Per-server outcomes | Each MCP server’s Status, HTTP response code, and Duration (ms), when the request reached more than one MCP server |
| Relevant events | The Workload Events and Access Authorization Events for the request |
MCP Access Activities and the Activity Detail page open only when your role has Read Only permission on Workload Events. Access decisions and the Access Authorization Events in Relevant events appear only when your role also has Read Only permission on Access Authorization Events. See Roles.
In Access decisions, Boundary shows MCP client → Gateway access or Gateway → MCP server access. Decision shows Authorized, Denied, or Unavailable. The section appears only when the request has at least one Access Policy decision.
When Aembit can’t find the event for an authorization the request references, Access decisions shows the Access Authorization boundary with Unavailable for Access Policy and Decision. Relevant events shows the same authorization with Outside source window as its time.