Skip to main content
Glama

mcp-easy-ai__wp_audit_list

Read-only

List entries from the MCP audit log: every tool call (reads included), refusals, authentication failures and OAuth authorize/device/refresh events, newest first. Each entry carries the acting user, the credential source (legacy API key or oauth), the OAuth client, the redacted arguments, the result status, the tool duration in milliseconds and the client IP. Filter by free text over tool name and arguments, tool, user, client, source, status, token id or date range. Admin only. For before/after snapshots of what a call changed, use wp_history_list with the entry id as audit_id. Through Royally: its server marks it read-only, so it runs straight away.

Input Schema

NameRequiredDescriptionDefault
limitNo
sinceNoGMT datetime, e.g. 2026-05-01 00:00:00
untilNo
offsetNo
searchNoFree-text match over the tool name and the redacted arguments (case-insensitive substring).
site_idNoSite to run this tool on: 8ef2e52b-bd07-4671-a363-ebe8b480b65c (https://demo.royalplugins.com)
token_idNoCredential row id. Combine with auth_source: the id is from the API-key table for legacy rows and from the OAuth access-token table for oauth rows.
before_idNoSnapshot bound for paging: only rows with id <= this value. Omit on the first page; the response returns the before_id it used, pass that back with the next offset so later pages cannot shift when new rows (including this call's own audit row) arrive.
tool_nameNoExact tool name, e.g. wp_update_post. Internal events use a leading underscore: _auth_failure, _oauth_authorize, _oauth_device, _oauth_refresh.
wp_user_idNoWordPress user the credential belongs to.
auth_sourceNolegacy = API key, oauth = OAuth 2.1 grant, unknown = rows written before the source was recorded.
result_statusNosuccess, error, pending, refused, auth_failure, or an OAuth refresh event name.
oauth_client_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only/non-destructive, and the description adds real context beyond them: admin-only authorization, redaction of arguments, newest-first ordering, inclusion of read operations, and an explanation that the server-side read-only marking means it executes without a confirmation step. It also documents the fields each row returns, which is the main behavioral unknown here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and scoping, then filters, then the sibling alternative. Dense but nearly every clause carries information; the trailing "Through Royally: its server marks it read-only, so it runs straight away" is the one line that borders on restating the annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter read-only listing tool with no output schema, the description supplies the return shape, ordering, filtering model, permission requirement and the sibling hand-off for diffs. An agent has everything needed to decide to call it and to build a valid first query.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

At 69% schema coverage across 13 parameters, the description carries useful weight: it enumerates the filter axes (free text over tool name and arguments, tool, user, client, source, status, token id, date range), mapping them to search, tool_name, wp_user_id, oauth_client_id, auth_source, result_status, token_id, since/until. It leaves limit/offset/before_id/site_id to the schema, which documents before_id paging well — a small but real gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ("List entries from the MCP audit log") and immediately scopes what the log contains — tool calls including reads, refusals, auth failures, OAuth events — ordered newest first. It explicitly separates itself from the nearest sibling (wp_history_list) by naming the different job that one does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit routing rule: use this to list audit entries, and "For before/after snapshots of what a call changed, use wp_history_list with the entry id as audit_id." It also states the "Admin only" prerequisite, so the agent knows both when to call it and when it cannot.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources