MCP proxy security monitoring: what is honestly visible today

2026-10-17 — MCP did for agents what USB did for peripherals: suddenly every tool talks to every agent through one socket, and most of that traffic is invisible to any log you already keep. The security conversation mostly jumps to gating and blocking. There is an earlier question worth answering with evidence instead of vibes: from where you sit, what can you actually see today?

The layer where the actions live

Prompts are opinions; tool calls are actions. An MCP-connected agent’s real blast radius is its server list: which servers are reachable, which tools they expose, and which calls actually fly. That transport seam — the client‑to‑server traffic and the local processes behind it — is where a runtime can observe without pretending to read anybody’s mind.

What Phase 0 records for MCP-shaped actions

• which agent family and process lineage initiated the traffic — attribution before interpretation
• the tool-call shape: server, tool, argument envelope — normalized form, not private payload; the redaction layer runs before anything is logged
• the file, process and network side effects the call produced on the machine — because the interesting part of a tool call is what it then touched
• the policy verdict in force at the moment of the action — currently observe-and-note (would_block style); gating MCP calls is roadmap, and this page does not pre-spend it

What this page deliberately does not claim

No content-level scanning promises, no “malicious MCP server detected” theater, no enforcement verbs. Detection depth for the MCP transport layer is stated per integration on <a href="/en/supported-agents/">supported agents</a>, and the current build is explicit about what is observation versus what is prevention (<a href="/en/security/">security model</a>). Pretending Phase 1 capabilities on a Phase 0 page is how trust gets spent before the code earns it.

Where to go from here

The record format is on the <a href="/en/docs/">docs</a> side, with the audit trail walked through line by line in <a href="/en/blog/agent-actions-audit-trail/">this post</a>. If you run MCP servers under coding agents and want the verdict-gated version of this traffic, the <a href="/en/early-access/">Early Access waitlist</a> is the shortest honest path — and the feature-request shape you send is what the rule file gets tuned against.