Skip to main content
Glama

List audit events

list_audit_events
Read-only

Search the organization's audit log, newest first by default: who did what to which subject and how it ended, every approval decision, pipeline outcome, configuration change and API key action included. Filters combine; page with next_cursor. total_count is how many events match.

Input Schema

NameRequiredDescriptionDefault
qNoFree text over the event type, the actor's name and id, the subject id, the event id and the event's data.
sortNooccurred (the default), event_type or actor.
limitNoHow many events per page, 1 to 500. Defaults to 100.
orderNodesc for newest first (the default) or asc.
to_atNoOnly events before this RFC 3339 time.
cursorNoThe next_cursor of the previous page; keep the same filters, sort and order.
from_atNoOnly events at or after this RFC 3339 time.
outcomeNoOnly events whose action ended this way: approved, denied, expired, cancelled, human or blocked.
actor_idNoOnly events by one actor: a membership or user id, an agent's slug, or an API key's id.
actor_typeNoOnly events by this kind of actor: human, agent, system or api_key.
subject_idNoOnly events about one subject; requires subject_type. An agent is given by its slug, everything else by its id.
event_typesNoOnly events of these types, from list_audit_event_types.
subject_typeNoOnly events about this kind of thing, such as approval_request, membership or request_approval_pipeline.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint true, destructive false, openWorld false), so credit goes to what is added: default newest-first ordering, a documented "filters combine" conjunction rule, a cursor-based pagination contract, and the meaning of total_count. Missing only rate limits, permission requirements, or default page size behavior across the 13 filters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, ledger-style, front-loaded with the verb and resource before operational details. The middle clause ("who did what to which subject and how it ended, every approval decision, pipeline outcome, configuration change and API key action") is slightly list-heavy but earns its place by conveying coverage breadth.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter, zero-required tool with no output schema, the description covers the essentials an agent needs: defaults, filter conjunction, cursor paging, and the two return fields that matter (next_cursor, total_count). A note on empty-result behavior or per-page maximum would round it out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter including the sort/order defaults and the subject_id-requires-subject_type rule. The description reinforces default ordering and the pagination invariant (same filters/sort/order when cursoring) but adds little that the schema does not already say — baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (search the organization's audit log) plus the content it covers — actor, subject, outcome, approval decisions, pipeline outcomes, config changes, API key actions. An agent can distinguish it from get_audit_event on scope alone, but no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Filters combine; page with next_cursor" gives real operating guidance on how to drive the tool, but there is no statement of when to prefer this over get_audit_event or list_audit_event_types, and no exclusions. Usage is implied rather than directed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.