How to review MCP Access Exceptions

MCP Access Exceptions lists the requests that went through the with an error or an exception code. It groups requests that share a user, MCP client, MCP server, method, target, and exception, and counts the requests in each group. Requests that reached more than one MCP server share a Multiple row, whichever servers they reached. Use it to find which MCP requests had an error or an exception, for whom, and why. To review MCP requests with no error or exception code, use MCP Access Activities.

What counts as an exception

A request is one MCP operation from an MCP client, such as one tools/call. Aembit groups every the MCP Identity Gateway records for that operation into one request, including the events for each MCP server the request reaches.

A request counts as an exception when any of its events has severity Error or carries an exception code or an exception category. Exception codes with Warning severity count too, such as AIDR_UNAVAILABLE_FAIL_OPEN_BYPASS and CONFLICTING_RESOURCE_URI.

MCP Access Exceptions includes only requests through MCP Identity Gateway 1.35.6263 or later. See MCP Identity Gateway supported versions. The MCP Identity Gateway records no Workload Event for a request it rejects because its access token is missing, unverifiable, or expired, so MCP Access Exceptions doesn’t show it.

What MCP Access Exceptions displays

Each row holds the requests that share every value from User to Exception Code. MCP Access Exceptions shows requests in the you’re working in.

Column	Description
Time (UTC)	The time of the most recent request in the row.
User	The user Aembit recorded for the request.
MCP Client	The name of the that the MCP Identity Gateway identified as the MCP client. It’s not the name of the MCP client product.
MCP Server	The MCP server the MCP Identity Gateway forwarded the request to.
MCP Method	The MCP method, such as `tools/call` or `resources/read`.
Target	The tool name, resource URI, prompt name, or task ID that the request names.
Category	The exception category of one event in the request, such as MCP Server.
Exception Code	The label of that same event’s exception code, such as Invalid Audience. Hover over the label to see the code’s message.
Requests	The number of requests in the row.

A request can have more than one event with an error or an exception. The row then shows the category and code of the most recent event that carries an exception code. When none carries a code, the row uses the most recent event that carries a category.

When a column has no value for a request, it shows one of these instead:

Value	Column	Meaning
Unknown	User	The request’s events don’t name a user.
Unknown	Category	The event the row describes carries no exception category.
Unknown	Exception Code	The event the row describes carries no exception code.
Unavailable	MCP Method	The request’s events don’t name the MCP method.
Not applicable	Target	Aembit recorded no tool name, resource URI, prompt name, or task ID for the request.
Not determined	MCP Client	The request’s events don’t name a Client Workload.
Not determined	MCP Server	The MCP Identity Gateway didn’t forward the request to an MCP server.
Multiple	MCP Server	Each request reached more than one MCP server, and requests that reached different servers share the row. Hover over Multiple to list them.

Review MCP Access Exceptions

Log into your .
Click Reporting in the left sidebar.
At the top, select Reporting ☰ MCP Access Exceptions.

Aembit displays the MCP Access Exceptions page, with the rows that have the most requests first. By default, it shows requests from the last 24 hours. When you return to the report, it keeps the timespan and filters you last set.

Use any of these controls to narrow the list:

Control	What it does
Timespan	Sets a period within the last 24 hours
User	Matches part of the user identifier Aembit recorded
MCP Client	Matches part of a value
MCP Server	Matches part of a value, and keeps a Multiple row when one of its MCP servers matches
MCP Method	Accepts more than one value
Target	Matches part of a value
Category	Accepts more than one value, and limits the Exception Code options to the codes it contains
Exception Code	Accepts more than one value
Search box	Searches every column except Time (UTC) at once

Hover over a value in Exception Code to see its message. For every code and its message, see MCP exception codes.

Review the requests in a row

Open a row to see each request in it. For a request you select, Aembit shows its error or exception and the events it produced. It also shows the decisions behind the request.

Click a row in MCP Access Exceptions.

Aembit displays the Exception Detail page for that row.
In Exception summary, review the row’s values, including First seen, Last seen, Category, and Exception code.
In Request history, find the request to review.

Each row is one request, with its Time (UTC), Result, HTTP response code, and Server reached. The count beside the heading is the total number of requests, across all pages.
Click View events on the request.

Aembit updates Exception summary for that request and displays the sections described in the following tables.
In Relevant events, click Open event to see an event’s raw JSON in the Event details panel.

After you select a request, these Exception summary fields describe that request:

Field	What it shows
Result	Error when an event in the request has `Error` severity, and Success otherwise
HTTP response code	The HTTP response code for the request
Raw reason	The reason Aembit recorded for the error or exception, or the exception code’s message when Aembit recorded no reason
Client access decision	The decision for the MCP client’s access to the MCP Identity Gateway, with its Access Policy. It appears only when Aembit has one

Result shows Success when none of the request’s events has Error severity, even though the request carries an exception code.

The Exception Detail page also shows these sections for the selected request:

Section	What it shows
Access decisions	Each Access Policy decision for the request, with its Boundary, Access Policy, and Decision
Per-server outcomes	Each MCP server’s Status, HTTP code, Category, Exception code, Raw reason, and Duration (ms), when the MCP Identity Gateway forwarded the request
Relevant events	The Workload Events and Access Authorization Events for the request

MCP Access Exceptions shows requests, and the Exception Detail page opens, only when your role has Read Only permission on Workload Events. Access decisions, Client access decision, and the Access Authorization Events in Relevant events appear only when your role also has Read Only permission on Access Authorization Events. See Roles.

In Access decisions, Boundary shows MCP client → Gateway access or Gateway → MCP server access.

Decision shows Authorized, Denied, or Unavailable. The section appears only when the request has at least one Access Policy decision.

When Aembit can’t find the event for an authorization the request references, Access decisions shows the Access Authorization boundary with Unavailable for Access Policy and Decision. Relevant events shows the same authorization with Outside source window as its time.

What counts as an exception

What MCP Access Exceptions displays

Review MCP Access Exceptions

Review the requests in a row

Related pages