After a security incident where a Copilot agent is suspected of accessing files outside its intended scope, the forensics team cannot determine which specific tool calls were made, with what parameters, or in what order, because no tool-level logging was implemented. What should be added to the MCP server to support future forensic investigations?
Select an answer to reveal the explanation.
Short Explanation and Infographic
MCP tool-level audit logs are like the black box on a flight: they capture every input and output at the exact point of execution, in sequence, immutably. The model's reasoning (Option A) tells you what the agent was thinking; the MCP log tells you what it actually did—and these can differ, which is exactly what forensics needs to know.
Full explanation below image
Full Explanation
Forensic investigations of agentic AI incidents require logs at the right level of abstraction. GitHub's organization audit log captures platform-level events (API calls to GitHub's APIs), but MCP tool calls may involve internal tools, file system operations, or third-party APIs that are entirely outside GitHub's visibility.
A structured MCP audit log must capture: - Timestamp (with millisecond precision for ordering) - Agent session ID (to correlate all actions within a single run) - Tool name (which tool was invoked) - Input parameters (the full parameter set passed—critical for understanding what paths, queries, or targets were accessed) - Output summary (what the tool returned—needed to determine what data the agent received) - Outcome (success, error, denied by allow-list)
The logs must be written to an immutable store (append-only, write-once) so that a compromised agent or attacker cannot delete evidence.
Option A (agent reasoning in output) captures what the model intended, which is useful context but not a substitute for what actually executed. Prompt injection attacks are often designed to make the model think it's doing one thing while actually doing another—making the model's stated reasoning unreliable as forensic evidence. Option C (GitHub audit log) only covers GitHub API calls; internal tool calls are invisible to it. Option D (video capture) is impractical, unstructured, and cannot be efficiently queried during an investigation.