@agent-audit/mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AGENT_AUDIT_SINK | No | 写入器配置（JSON 数组，如 [{"type":"jsonl","filePath":"./audit-events.jsonl"}]） | |
| AGENT_AUDIT_LOG_LEVEL | No | 日志级别 | |
| AGENT_AUDIT_TRANSPORT | No | 传输方式，仅支持 stdio | |
| AGENT_AUDIT_BUFFER_SIZE | No | 内存缓冲大小（正整数） | |
| AGENT_AUDIT_NOTIFICATIONS | No | 通知开关，true / false | |
| AGENT_AUDIT_FLUSH_INTERVAL | No | 定时落盘间隔（毫秒） | |
| AGENT_AUDIT_FLUSH_THRESHOLD | No | 批量落盘条数阈值 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| audit_start_traceC | 开始一次新的审计追踪，返回追踪会话信息 |
| audit_record_eventC | 向指定追踪会话记录一条行为事件 |
| audit_end_traceB | 结束指定追踪会话并返回事件汇总 |
| audit_get_trailB | 查询指定追踪会话的审计事件列表 |
| audit_export_reportB | 按需导出审计事件或追踪时间线为 Markdown 报告 |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a uniquely identifiable role in the audit lifecycle: starting traces, recording events, ending traces, querying trails, and exporting reports. There is no overlap in their purposes.
All tool names follow the consistent pattern 'audit_<verb>_<noun>' (e.g., audit_start_trace, audit_record_event). The naming is uniform and predictable.
With 5 tools, the server is well-scoped for audit management. Each tool is necessary and sufficient, covering the lifecycle without unnecessary additions.
The tool surface fully covers the core audit workflow: start, record, end, retrieve, and export. Since audit trails are typically immutable, the absence of update/delete operations is appropriate and not a gap.