Auditing Database Tools MCP Server

The MCP server generates audit events to Oracle Cloud Infrastructure (OCI) Audit when API operations are executed. The audit event that is generated for MCP server operations is InvokeMcpServer.

Each audit event includes the following important fields:

Property	Description
eventType	Identifies the API operation. Value is "com.oraclecloud.dbtools-service-mcp.InvokeMcpServer"
source	The service that executed the event. Value is "DatabaseToolsMcp"
eventId	Unique identifier for the event
eventTime	Time the request was initiated.
data.eventName	Operation Id value from API spec. Value is "InvokeMcpServer"
data.compartmentId	OCID of the compartment where the event is taking place.
data.compartmentName	Friendly name associated with the compartment Id
data.resourceId	The OCID of the MCP Server.
data.availabilityDomain	The availability domain of the resource.
data.identity.principalName	The name of the user or service that triggered this event. Access Token claim: If "sub_type" == "user", "user_displayname" If "sub_type" == "client", "client_name"
data.identity.principalId	The OCID of the user or service that triggered the event. Access Token claim: "sub"
data.identity.tenantId	OCID of the tenancy. Access Token claim: "ca_ocid"
data.identity.ipAddress	IP address of the actual user executing the request.
data.identity.authType	Native, Federated, OBO, ServiceToService Value is Bearer
data.request.id	Unique identifier for a request (opc-request-id).
data.request.path	The full path of the API request.
data.request.action	HTTP request type such as GET, PUT, POST.
data.response.status	HTTP response code indicating status of the API call (Example: 200, 500).
data.response.message	Description of the operation result.

The following example shows a simplified audit log entry for an MCP server invocation:

{
  "eventType": "com.oraclecloud.dbtools-service-mcp.InvokeMcpServer",
  "source": "DatabaseToolsMcp",
  "eventTime": "2026-04-28T10:00:00Z",
  "eventId": "example-event-id",
  "data": {
    "eventName": "InvokeMcpServer",
    "compartmentId": "ocid1.compartment.oc1..example",
    "compartmentName": "ExampleCompartment",
    "resourceId": "ocid1.mcpserver.oc1..example",
    "resourceName": "ExampleMcpServer",
    "availabilityDomain": "Uocm:PHX-AD-1",
    "identity": {
      "principalName": "user@example.com",
      "principalId": "ocid1.user.oc1..example",
      "tenantId": "ocid1.tenancy.oc1..example",
      "ipAddress": "192.0.2.1",
      "authType": "Bearer"
    },
    "request": {
      "action": "POST",
      "path": "/mcp/invoke",
      "id": "example-opc-request-id"
    },
    "response": {
      "status": 200,
      "message": "ExampleMcpServer InvokeMcpServer succeeded"
    }
  }
}

Additional fields may be present in the audit event. For the complete scheme, see the OCI Audit documentation.

Filtering MCP Audit Events

To filter MCP-related audit events, use:

eventType = "com.oraclecloud.dbtools-service-mcp.InvokeMcpServer"

Oracle Cloud Infrastructure Documentation

Auditing Database Tools MCP Server