Skip to content

MCP access part 3: audit events and reporting #54779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
greedy52 merged 3 commits into from
May 29, 2025
Merged

MCP access part 3: audit events and reporting #54779

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d7cee4b
MCP access part 3: audit events and reporting
greedy52 May 13, 2025
52a386b
add new icon, storybook, format
greedy52 May 23, 2025
7a02f9e
Merge branch 'master' of github.com:gravitational/teleport into STeve…
greedy52 May 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
173 changes: 173 additions & 0 deletions api/proto/teleport/legacy/types/events/events.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4806,6 +4806,10 @@ message OneOf {
events.AutoUpdateAgentRolloutTrigger AutoUpdateAgentRolloutTrigger = 213;
events.AutoUpdateAgentRolloutForceDone AutoUpdateAgentRolloutForceDone = 214;
events.AutoUpdateAgentRolloutRollback AutoUpdateAgentRolloutRollback = 215;
events.MCPSessionStart MCPSessionStart = 216;
events.MCPSessionEnd MCPSessionEnd = 217;
events.MCPSessionRequest MCPSessionRequest = 218;
Copy link
Copy Markdown
Collaborator

@zmb3 zmb3 May 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this work like app access where the requests get chunked up and stored in session recordings, or are we emitting every request directly to the audit log?

Copy link
Copy Markdown
Contributor Author

@greedy52 greedy52 May 20, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

they go straight to audit events similar to database queries. LLMs "execute" these requests based on user's behaves (like the inputs on the prompt) so don't expect a huge number of request to spam audit log. Any concern? we could introduce audit event vs recording mode for these but we never get to do that for database access.

events.MCPSessionNotification MCPSessionNotification = 219;
}
}

Expand Down Expand Up @@ -8515,3 +8519,172 @@ message SigstorePolicyDelete {
(gogoproto.jsontag) = ""
];
}

// MCPSessionStart is emitted when a user starts a MCP session.
message MCPSessionStart {
// Metadata is a common event metadata
Metadata Metadata = 1 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// User is a common user event metadata
UserMetadata User = 2 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// SessionMetadata is a common event session metadata
SessionMetadata Session = 3 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// ServerMetadata is a common server metadata
ServerMetadata Server = 4 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// ConnectionMetadata holds information about the connection
ConnectionMetadata Connection = 5 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// App is a common application resource metadata.
AppMetadata App = 6 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
}

// MCPSessionEnd is emitted when an MCP session ends.
message MCPSessionEnd {
// Metadata is a common event metadata
Metadata Metadata = 1 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// User is a common user event metadata
UserMetadata User = 2 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// SessionMetadata is a common event session metadata
SessionMetadata Session = 3 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// ServerMetadata is a common server metadata
ServerMetadata Server = 4 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// ConnectionMetadata holds information about the connection
ConnectionMetadata Connection = 5 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// App is a common application resource metadata.
AppMetadata App = 6 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
}

// MCPJSONRPCMessage includes details of a MCP request or notification.
// https://modelcontextprotocol.io/docs/concepts/transports#requests
message MCPJSONRPCMessage {
// JSONRPC specifies the version of the protocol.
string JSONRPC = 1 [(gogoproto.jsontag) = "jsonrpc"];
// ID is the ID of a request. Notifications have no IDs.
string ID = 2 [(gogoproto.jsontag) = "id,omitempty"];
// Method is the method of this message.
string method = 3 [(gogoproto.jsontag) = "method"];
// Params is the optional parameters.
google.protobuf.Struct params = 5 [
(gogoproto.jsontag) = "params,omitempty",
(gogoproto.casttype) = "Struct"
];
}

// MCPSessionRequest is emitted when a request is sent by client during a MCP session.
message MCPSessionRequest {
// Metadata is a common event metadata
Metadata metadata = 1 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// User is a common user event metadata
UserMetadata user = 2 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// SessionMetadata is a common event session metadata
SessionMetadata session = 3 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// App is a common application resource metadata.
AppMetadata App = 4 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// Status contains information whether the request is successful or not.
Status status = 5 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// Message contains details of the message.
MCPJSONRPCMessage message = 6 [
(gogoproto.nullable) = false,
(gogoproto.jsontag) = "message,omitempty"
];
}

// MCPSessionNotification is emitted when a notification is sent by client
// during a MCP session.
message MCPSessionNotification {
// Metadata is a common event metadata
Metadata metadata = 1 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// User is a common user event metadata
UserMetadata user = 2 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// SessionMetadata is a common event session metadata
SessionMetadata session = 3 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// App is a common application resource metadata.
AppMetadata App = 4 [
(gogoproto.nullable) = false,
(gogoproto.embed) = true,
(gogoproto.jsontag) = ""
];
// Message contains details of the message.
MCPJSONRPCMessage message = 5 [
(gogoproto.nullable) = false,
(gogoproto.jsontag) = "message,omitempty"
];
}
72 changes: 61 additions & 11 deletions api/types/events/events.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ func (m *Struct) nonEmptyStrs() int {
return toTrim
}

func (m *Struct) trimToMaxSize(maxSize int) *Struct {
func (m *Struct) trimToMaxFieldSize(maxFieldSize int) *Struct {
if len(m.Fields) == 0 {
return m
}
Expand All @@ -194,11 +194,11 @@ func (m *Struct) trimToMaxSize(maxSize int) *Struct {
},
}
for k, v := range m.Fields {
trimmedKey := trimStr(k, maxSize)
trimmedKey := trimStr(k, maxFieldSize)

if v != nil {
if strVal := v.GetStringValue(); strVal != "" {
trimmedVal := trimStr(strVal, maxSize)
trimmedVal := trimStr(strVal, maxFieldSize)
out.Fields[trimmedKey] = &types.Value{
Kind: &types.Value_StringValue{
StringValue: trimmedVal,
Expand All @@ -207,7 +207,7 @@ func (m *Struct) trimToMaxSize(maxSize int) *Struct {
} else if l := v.GetListValue(); l != nil {
for i, lv := range l.Values {
if strVal := lv.GetStringValue(); strVal != "" {
trimmedVal := trimStr(strVal, maxSize)
trimmedVal := trimStr(strVal, maxFieldSize)
l.Values[i] = &types.Value{
Kind: &types.Value_StringValue{
StringValue: trimmedVal,
Expand Down Expand Up @@ -510,7 +510,7 @@ func (m *AccessRequestCreate) TrimToMaxSize(maxSize int) AuditEvent {

out.Roles = trimStrSlice(m.Roles, maxFieldsSize)
out.Reason = trimStr(m.Reason, maxFieldsSize)
out.Annotations = m.Annotations.trimToMaxSize(maxFieldsSize)
out.Annotations = m.Annotations.trimToMaxFieldSize(maxFieldsSize)

return out
}
Expand Down Expand Up @@ -815,7 +815,7 @@ func (m *AppSessionDynamoDBRequest) TrimToMaxSize(maxSize int) AuditEvent {
out.Path = trimStr(m.Path, maxFieldsSize)
out.RawQuery = trimStr(m.RawQuery, maxFieldsSize)
out.Target = trimStr(m.Target, maxFieldsSize)
out.Body = m.Body.trimToMaxSize(maxFieldsSize)
out.Body = m.Body.trimToMaxFieldSize(maxFieldsSize)

return out
}
Expand Down Expand Up @@ -1305,7 +1305,7 @@ func (m *DynamoDBRequest) TrimToMaxSize(maxSize int) AuditEvent {

out.Path = trimStr(m.Path, maxFieldsSize)
out.RawQuery = trimStr(m.RawQuery, maxFieldsSize)
out.Body = m.Body.trimToMaxSize(maxFieldsSize)
out.Body = m.Body.trimToMaxFieldSize(maxFieldsSize)
out.Target = trimStr(m.Target, maxFieldsSize)

return out
Expand Down Expand Up @@ -1663,7 +1663,7 @@ func (m *BotJoin) TrimToMaxSize(maxSize int) AuditEvent {
customFieldsCount := m.Attributes.nonEmptyStrs()
maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)

out.Attributes = m.Attributes.trimToMaxSize(maxFieldsSize)
out.Attributes = m.Attributes.trimToMaxFieldSize(maxFieldsSize)

return out
}
Expand Down Expand Up @@ -2161,7 +2161,7 @@ func (m *SpannerRPC) TrimToMaxSize(maxSize int) AuditEvent {

out.Status = m.Status.trimToMaxSize(maxFieldsSize)
out.Procedure = trimStr(m.Procedure, maxFieldsSize)
out.Args = m.Args.trimToMaxSize(maxFieldsSize)
out.Args = m.Args.trimToMaxFieldSize(maxFieldsSize)

return out
}
Expand Down Expand Up @@ -2422,7 +2422,7 @@ func (m *WorkloadIdentityCreate) TrimToMaxSize(maxSize int) AuditEvent {
customFieldsCount := m.WorkloadIdentityData.nonEmptyStrs()
maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)

out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxSize(maxFieldsSize)
out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxFieldSize(maxFieldsSize)

return out
}
Expand All @@ -2441,7 +2441,7 @@ func (m *WorkloadIdentityUpdate) TrimToMaxSize(maxSize int) AuditEvent {
customFieldsCount := m.WorkloadIdentityData.nonEmptyStrs()
maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)

out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxSize(maxFieldsSize)
out.WorkloadIdentityData = m.WorkloadIdentityData.trimToMaxFieldSize(maxFieldsSize)

return out
}
Expand Down Expand Up @@ -2548,3 +2548,53 @@ func (m *SigstorePolicyUpdate) TrimToMaxSize(int) AuditEvent {
func (m *SigstorePolicyDelete) TrimToMaxSize(int) AuditEvent {
return m
}

func (m *MCPSessionStart) TrimToMaxSize(maxSize int) AuditEvent {
return m
}
func (m *MCPSessionEnd) TrimToMaxSize(maxSize int) AuditEvent {
return m
}

func (m *MCPJSONRPCMessage) trimToMaxSize(maxSize int) MCPJSONRPCMessage {
if m == nil {
return MCPJSONRPCMessage{}
}

out := MCPJSONRPCMessage{}

customFieldsCount := nonEmptyStrs(m.JSONRPC, m.ID, m.Method) + m.Params.nonEmptyStrs()
maxFieldsSize := maxSizePerField(maxSize, customFieldsCount)

out.JSONRPC = trimStr(m.JSONRPC, maxFieldsSize)
out.ID = trimStr(m.ID, maxFieldsSize)
out.Method = trimStr(m.Method, maxFieldsSize)
out.Params = m.Params.trimToMaxFieldSize(maxFieldsSize)
return out
}

func (m *MCPSessionRequest) TrimToMaxSize(maxSize int) AuditEvent {
size := m.Size()
if size <= maxSize {
return m
}

out := utils.CloneProtoMsg(m)
out.Message = MCPJSONRPCMessage{}
maxSize = adjustedMaxSize(out, maxSize)
out.Message = m.Message.trimToMaxSize(maxSize)
return out
}

func (m *MCPSessionNotification) TrimToMaxSize(maxSize int) AuditEvent {
size := m.Size()
if size <= maxSize {
return m
}

out := utils.CloneProtoMsg(m)
out.Message = MCPJSONRPCMessage{}
maxSize = adjustedMaxSize(out, maxSize)
out.Message = m.Message.trimToMaxSize(maxSize)
return out
}
Loading
Loading