Stream Your MCP Audit Logs to Your Own Grafana, Sentry, or Webhook

Short answer: MCP Trail now has log drains. Point one at your own Loki, Sentry/GlitchTip, or any HTTPS webhook, and every proxied MCP tool call in your workspace — scope, tool, status, correlation id, cost, and timing — flows into the observability stack you already run. It’s tenant-scoped, the config is encrypted, destinations are SSRF-checked, and there’s a one-click test before real traffic flows.

MCP Trail already records every call in the in-app audit log and analytics. But most teams already have a place where all their other logs, dashboards, and alerts live — Grafana, Sentry, Datadog, an internal pipeline. Log drains let your MCP governance data land there too, so you keep long-term history off-platform and alert on it however you already do.

What gets sent

Each drain forwards audit events: one structured record per proxied call, carrying the server scope, tool name, MCP method, decision status (allowed, blocked, redacted, an approval outcome…), a correlation_id, cost, and timing.

You choose the redaction level per drain:

• Metadata (default) — event metadata only.
• Scrubbed arguments — also include the tool arguments, already scrubbed by MCP Trail’s DLP.

Raw secrets, tokens, and DSNs are never sent, and never returned to the dashboard or API.

Three destinations

Loki → your Grafana. Give your Loki push URL and auth (bearer / basic / X-Scope-OrgID). Events arrive as streams labelled by service and status; high-cardinality fields stay in the line, so you query them with {service="my-server"} | json | correlation_id="…".

Sentry / GlitchTip. Paste your project DSN and pick which statuses become issues (only blocked

• errors, or everything). Each event is tagged with server, tool, status, and correlation_id so you can group and alert.

Webhook. Any HTTPS endpoint that accepts a JSON POST — Datadog intake, a Lambda, your own pipeline. Batches arrive as { "source": "mcptrail", "count": N, "events": [ … ] }.

Trace one request everywhere

Every event carries a correlation_id. Copy it from an alert or the audit log, paste it into your own Grafana or Sentry, and you have the full story of that request in the tool your team already lives in — no context-switching into a second dashboard.

Built to stay out of the way

• SSRF-guarded at save and at delivery — a drain can’t be aimed at an internal or cloud-metadata address.
• Encrypted at rest — URLs, auth headers, and DSNs.
• Rate-capped per plan — over the cap the oldest events drop and the drain is flagged throttled; your MCP traffic is never slowed by a slow or unreachable destination.
• Per-drain isolation — one bad endpoint never affects your other drains or your calls.

Turn it on

Log drains are available on Team and above. Open Dashboard → Log drains → Add drain, pick a destination, and hit Test. Full setup — including self-hosting the delivery worker — is in the Log drains docs.

Create a free account and start governing — and now, streaming — your MCP traffic.