Runtime Request And Response Logging

Purpose

This functional area captures sanitized request and response payload data during tool execution and stores it as audit dimensions for governance and operational review.

It is an opt-in feature controlled at the toolset and endpoint level.

Main Capabilities

• capture MCP request and response payloads
• capture downstream HTTP request and response payloads
• sanitize payloads to remove sensitive values
• truncate captured data to a configurable size limit
• store captured data as dimensions in governance audit records
• support per-endpoint overrides of the toolset-level logging setting

What Is Captured

When request/response logging is enabled for a tool, the following data is captured and stored as audit dimensions:

For MCP-based invocations:

• the raw MCP request payload body
• the raw MCP response payload body

For tools/list responses (MCP tool discovery):

• the serialized MCP tools list response payload is captured as an audit dimension whenever at least one tool in the response has request/response logging enabled

For downstream HTTP calls:

• the outbound HTTP method, target URL, headers, and body
• the inbound HTTP status code, response headers, and body

Sanitization

All captured payloads pass through a sanitization step before storage.

Sanitization rules include:

• sensitive HTTP headers (Authorization, token-related, API keys, secrets, cookies) have their values replaced with [redacted]
• sensitive JSON property names and values are replaced with [redacted]
• sensitive URL query string parameters are replaced with [redacted]
• SOAP security headers and credential-derived values are replaced with [redacted]
• multipart/form-data request bodies are omitted with a descriptive placeholder

Sensitive name detection covers names containing: authorization, token, api_key, apikey, api-key, secret, password, cookie.

Truncation

If a captured payload exceeds the configured maximum byte size, it is truncated to that limit and a truncation marker is appended to the stored value.

The default limit is 512 KB per captured dimension. This can be changed per toolset.

Configuration

Request/response logging is configured at the toolset level through the Portal.

Available settings:

• RequestResponseLoggingEnabled — whether logging is active for the toolset (disabled by default)
• RequestResponseLoggingMaxBodyBytes — the maximum byte size per captured dimension (default 512 KB)
• per-endpoint overrides — each endpoint in the toolset can independently enable or disable logging regardless of the toolset default

Audit Storage

Captured payloads are stored as key-value dimensions on the governance audit records for the relevant pipeline steps.

Administrators can view captured payload data in the Portal by opening the detail view of an individual audit record or by inspecting a call trace step.

The capture pipeline stores raw payload envelopes only as internal audit dimensions first. A governance sanitization step then rewrites them into the operator-facing payload fields shown in Portal audit and trace views.

Functional Value

This area supports audit, compliance, and debugging scenarios by making actual request and response content visible within the governance infrastructure, without requiring access to raw runtime logs or downstream system logs.