Skip to main content
Glama
This connector has been deprecated

This is a duplicate of the actual entry deprecating this in favor of the original.

list_audit_events

Read-only

Search the organization's audit log, newest first by default: who did what to which subject and how it ended, every approval decision, pipeline outcome, configuration change and API key action included. Filters combine; page with next_cursor. total_count is how many events match.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
qNoFree text over the event type, the actor's name and id, the subject id, the event id and the event's data.
sortNooccurred (the default), event_type or actor.
limitNoHow many events per page, 1 to 500. Defaults to 100.
orderNodesc for newest first (the default) or asc.
to_atNoOnly events before this RFC 3339 time.
cursorNoThe next_cursor of the previous page; keep the same filters, sort and order.
from_atNoOnly events at or after this RFC 3339 time.
outcomeNoOnly events whose action ended this way: approved, denied, expired, cancelled, human or blocked.
actor_idNoOnly events by one actor: a membership or user id, an agent's slug, or an API key's id.
actor_typeNoOnly events by this kind of actor: human, agent, system or api_key.
subject_idNoOnly events about one subject; requires subject_type. An agent is given by its slug, everything else by its id.
event_typesNoOnly events of these types, from list_audit_event_types.
subject_typeNoOnly events about this kind of thing, such as approval_request, membership or request_approval_pipeline.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish the safe read profile (readOnlyHint=true, destructiveHint=false, openWorldHint=false). The description adds behavior beyond that: default newest-first ordering, that filters are conjunctive, the cursor-based paging mechanism, and the meaning of total_count. It doesn't cover rate limits or result caps beyond limit's 500 bound in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the purpose before the mechanics. Nearly every clause carries information, though 'who did what to which subject and how it ended' is somewhat rhetorical filler versus the sharper coverage list that follows.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter, read-only search with no output schema, the description covers the essentials: what is searchable, filter semantics, ordering default, and the paging and count fields an agent will see in the response. Combined with 100% schema coverage, an agent has what it needs to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description earns above baseline by clarifying cross-parameter semantics that the schema does not: that multiple filters combine (AND) rather than override, that default sort is newest-first, and that total_count reflects the full match set rather than the page.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search the organization's audit log') and enumerates the event coverage (approval decisions, pipeline outcomes, configuration changes, API key actions), which makes the scope concrete. It does not explicitly name siblings like get_audit_event or list_audit_event_types, so the agent must infer the list-vs-single distinction from naming alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives operational guidance for using the tool ('Filters combine; page with next_cursor') but no when-to-use-this-vs-alternatives guidance. There is no mention of when to reach for get_audit_event on a single event, or of calling list_audit_event_types to discover valid values as implied by the event_types param description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources