search-audits
Search and filter Descope project audit logs by login IDs, actions, tenants, methods, or geographic locations to monitor authentication activity and security events.
Instructions
Search Descope project audit logs
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| loginIds | No | Filter by specific login IDs | |
| actions | No | Filter by specific action types | |
| excludedActions | No | Actions to exclude from results | |
| tenants | No | Filter by specific tenant IDs | |
| noTenants | No | If true, only show events without tenants | |
| methods | No | Filter by authentication methods | |
| geos | No | Filter by geographic locations | |
| hoursBack | No | Hours to look back (max 720 hours / 30 days) | |
| limit | No | Number of audit logs to fetch (max 10) |
Implementation Reference
- src/descope.ts:59-97 (handler)The asynchronous handler function that executes the search-audits tool. It searches Descope audit logs using the provided filters, limits the results, and returns a formatted text response.
async ({ loginIds, actions, excludedActions, tenants, noTenants, methods, geos, hoursBack, limit }) => { try { const now = Date.now(); const from = now - (hoursBack * 60 * 60 * 1000); const audits = await descope.management.audit.search({ from, to: now, loginIds, actions, excludedActions, tenants, noTenants, methods, geos, }); // Limit the number of audits to the specified limit const auditResponse = audits.data; const limitedAudits = auditResponse ? auditResponse.slice(0, limit) : []; return { content: [ { type: "text", text: `Audit logs for the last ${hoursBack} hours:\n\n${JSON.stringify(limitedAudits, null, 2)}`, }, ], }; } catch (error) { return { content: [ { type: "text", text: `Error fetching audit logs: ${error}`, }, ], }; } }, - src/descope.ts:36-58 (schema)Zod schema defining the input parameters and their descriptions for the search-audits tool.
{ // Optional filters loginIds: z.array(z.string()).optional() .describe("Filter by specific login IDs"), actions: z.array(z.string()).optional() .describe("Filter by specific action types"), excludedActions: z.array(z.string()).optional() .describe("Actions to exclude from results"), tenants: z.array(z.string()).optional() .describe("Filter by specific tenant IDs"), noTenants: z.boolean().optional() .describe("If true, only show events without tenants"), methods: z.array(z.string()).optional() .describe("Filter by authentication methods"), geos: z.array(z.string()).optional() .describe("Filter by geographic locations"), // Time range (defaults to last 24 hours) hoursBack: z.number().min(1).max(24 * 30).default(24) .describe("Hours to look back (max 720 hours / 30 days)"), // Limit (defaults to 5) limit: z.number().min(1).max(10).default(5) .describe("Number of audit logs to fetch (max 10)"), }, - src/descope.ts:33-98 (registration)Registration of the 'search-audits' tool on the MCP server, specifying name, description, input schema, and handler function.
server.tool( "search-audits", "Search Descope project audit logs", { // Optional filters loginIds: z.array(z.string()).optional() .describe("Filter by specific login IDs"), actions: z.array(z.string()).optional() .describe("Filter by specific action types"), excludedActions: z.array(z.string()).optional() .describe("Actions to exclude from results"), tenants: z.array(z.string()).optional() .describe("Filter by specific tenant IDs"), noTenants: z.boolean().optional() .describe("If true, only show events without tenants"), methods: z.array(z.string()).optional() .describe("Filter by authentication methods"), geos: z.array(z.string()).optional() .describe("Filter by geographic locations"), // Time range (defaults to last 24 hours) hoursBack: z.number().min(1).max(24 * 30).default(24) .describe("Hours to look back (max 720 hours / 30 days)"), // Limit (defaults to 5) limit: z.number().min(1).max(10).default(5) .describe("Number of audit logs to fetch (max 10)"), }, async ({ loginIds, actions, excludedActions, tenants, noTenants, methods, geos, hoursBack, limit }) => { try { const now = Date.now(); const from = now - (hoursBack * 60 * 60 * 1000); const audits = await descope.management.audit.search({ from, to: now, loginIds, actions, excludedActions, tenants, noTenants, methods, geos, }); // Limit the number of audits to the specified limit const auditResponse = audits.data; const limitedAudits = auditResponse ? auditResponse.slice(0, limit) : []; return { content: [ { type: "text", text: `Audit logs for the last ${hoursBack} hours:\n\n${JSON.stringify(limitedAudits, null, 2)}`, }, ], }; } catch (error) { return { content: [ { type: "text", text: `Error fetching audit logs: ${error}`, }, ], }; } }, );