Tamper-evident · Hash-chained · Object Lock archived

Every tool call. Every user. Every time.

Cytra Support's audit log captures every MCP tool call, every sign-in, every billing event — hash-chained for tamper detection and shipped to S3 with Object Lock for compliance retention.

Get your MCP URL Security details

SHA-256 hash chain

Each event includes the prior event's hash. Mutating one row invalidates every row that follows.

Workspace-scoped queries

Hot tier (Postgres) for sub-100ms UI. Cold tier (Athena over S3) for historical and forensic queries.

Configurable retention

7 days (Free) → 90 days (Team) → 365 days (Enterprise) hot. Up to 7-year Object Lock Compliance archive.

Sample audit event

Every event ships with the actor, target, IP, latency, cost, and a redacted payload. Sensitive fields (passwords, tokens, secrets) are stripped before persistence.

{
  "id": "01HV3K4M9P2N7B5F8GQXR8DJW1",
  "workspaceId": "550e8400-e29b-41d4-a716-446655440000",
  "category": "mcp.tool_call",
  "action": "mcp.tool.slack.send_message",
  "actorType": "api_key",
  "actorId": "ak_live_3jK...",
  "actorEmail": "agent@acme.com",
  "outcome": "success",
  "ipAddress": "203.0.113.42",
  "userAgent": "Claude/Desktop-0.7.4",
  "requestId": "req_01HV3K4M9P",
  "latencyMs": 412,
  "costCents": 2,
  "payload": {
    "appSlug": "slack",
    "tool": "send_message",
    "params": { "channel": "#sales", "text": "[REDACTED — 142 chars]" },
    "responseSummary": { "ok": true, "ts": "1714069200.0001" }
  },
  "prevHash": "9c4f1a8b...",
  "payloadHash": "e2d8c91a...",
  "createdAt": "2026-04-23T16:32:18.412Z"
}

SHA-256 chained

Redacted payload

Per-call cost attributed

Request-id correlated to OTel

What gets audited

auth

sign-in, sign-out, password change, MFA, failed-auth

mcp.tool_call

every tool call routed through /mcp/{slug}

mcp.connection

OAuth connect / disconnect of any backend

api_key

create, revoke, every authenticated use

member

invite, accept, role change, remove

billing

plan change, seat add / remove, payment success / fail

workspace

create, settings change, branding update

policy

policy create / update, approval grant / reject / expire

data

source connect, sync, document delete

admin

staff-mode actions (deactivate user, etc.)

See your first audit event in 5 minutes.

Get your MCP URL