Audit Log
MCP activity logging — log types, record fields, retention policy, and how to read the audit trail
Audit Log
The MCP server maintains a complete audit trail in ai_connector.audit_log. Every tool call, authentication event, permission denial, and error is recorded when logging is enabled.
Enable Logging
In Settings → General Settings → MCP Server:
- Enable Enable MCP Audit Logging (default: on)
When logging is disabled, only errors may still be captured depending on the error path.
[!NOTE] Screenshot — Audit Log List View
Place a screenshot of the MCP Server → Activity Log list view here, showing the log type badges, user, model, and operation columns. Suggested filename:
audit-log-list.png
Log Types
log_type | When It Is Written |
|---|---|
auth_success | Successful authentication on initialize or OAuth routes |
auth_failure | Failed authentication attempt |
model_access | Successful tool execution (after ORM call completes) |
permission_denied | MCP model policy denied the request |
error | Unhandled exception during tool execution |
rate_limit | User hit the rate limit on /mcp |
Log Record Fields
| Field | Description |
|---|---|
log_type | One of the types above |
user_id | The Odoo user who made the request |
client_name | AI client name (from _meta.clientInfo.name, X-Client-Name, or User-Agent) |
is_token_auth | True if authenticated via Bearer token; False for session |
user_prompt | Original user message (if passed via user_prompt or _meta) |
model_name | Technical model name (e.g. sale.order) |
operation | ORM operation attempted (e.g. search_read, write) |
request_data | Full tool call arguments (JSON, truncated at 10,000 chars) |
response_data | Tool response payload (JSON, truncated at 10,000 chars) |
duration_ms | Execution time in milliseconds |
ip_address | Requester IP address |
create_date | Timestamp when the log entry was created |
Audit Log Form View
[!NOTE] Screenshot — Audit Log Form View
Place a screenshot of an opened audit log record showing the Request Data and Response Data tabs. Suggested filename:
audit-log-form.png
The form view has two tabs:
- Request Data — the tool call arguments sent by the AI client
- Response Data — the response returned by the server
Log Skipping Conditions
Logging is skipped (even when enabled) in these cases:
| Condition | Reason |
|---|---|
request.env.cr.readonly | Read-only cursor — cannot write to log |
Context key skip_mcp_logging = True | Programmatic opt-out |
Context key test_mcp_logging absent in test mode | Test runs skip logging by default |
Retention and Purge
A daily scheduled action (MCP Server Activity Log Purge) automatically deletes log entries older than the configured retention period.
| Setting | Default | Description |
|---|---|---|
| MCP Log Retention (Days) | 30 | Logs older than N days are deleted by the daily cron |
| Retention = 0 | — | Disables automatic purge (logs accumulate indefinitely) |
Manual Purge
Administrators can trigger a purge from the Odoo shell:
env['ai_connector.audit_log'].purge_expired_history()
# Or pass a custom number of days:
env['ai_connector.audit_log'].purge_expired_history(days=7)Querying the Audit Log
# Last 10 model_access entries for sale.order
env['ai_connector.audit_log'].search_read(
[['model_name', '=', 'sale.order'], ['log_type', '=', 'model_access']],
['user_id', 'operation', 'duration_ms', 'create_date'],
limit=10,
order='create_date desc'
)