Tamper-evident · Hash-chained · Workspace-scoped

Every tool call. Every user. Every time.

Cytra Support's audit log captures every MCP tool call, every sign-in, every billing event — hash-chained for tamper detection, retained in the hot tier by plan, with an optional long-term S3 export planned.

Get your MCP URL Security details

SHA-256 hash chain

Each event includes the prior event's hash. Mutating one row invalidates every row that follows.

Workspace-scoped queries

Hot tier on Cloudflare D1, scoped to your workspace, for the dashboard, forensic review, and CSV export. A long-term archive query tier is planned.

Configurable retention

7 days (Free) → 90 days (Team) → 365 days (Enterprise) in the hot tier. Longer retention via an optional S3 archive export is planned.

Sample audit event

Every event ships with the actor, target, IP, latency, cost, and a redacted payload. Sensitive fields (passwords, tokens, secrets) are stripped before persistence.

{
  "id": "01HV3K4M9P2N7B5F8GQXR8DJW1",
  "workspaceId": "550e8400-e29b-41d4-a716-446655440000",
  "category": "mcp.tool_call",
  "action": "mcp.tool.slack.send_message",
  "actorType": "api_key",
  "actorId": "ak_live_3jK...",
  "actorEmail": "agent@acme.com",
  "outcome": "success",
  "ipAddress": "203.0.113.42",
  "userAgent": "Claude/Desktop-0.7.4",
  "requestId": "req_01HV3K4M9P",
  "latencyMs": 412,
  "costCents": 2,
  "payload": {
    "appSlug": "slack",
    "tool": "send_message",
    "params": { "channel": "#sales", "text": "[REDACTED — 142 chars]" },
    "responseSummary": { "ok": true, "ts": "1714069200.0001" }
  },
  "prevHash": "9c4f1a8b...",
  "payloadHash": "e2d8c91a...",
  "createdAt": "2026-04-23T16:32:18.412Z"
}

SHA-256 chained

Redacted payload

Per-call cost attributed

Request-id correlated to OTel

What gets audited

auth

sign-in, sign-out, password change, MFA, failed-auth

mcp.tool_call

every tool call routed through /mcp/{slug}

mcp.connection

OAuth connect / disconnect of any backend

api_key

create, revoke, every authenticated use

member

invite, accept, role change, remove

billing

plan change, seat add / remove, payment success / fail

workspace

create, settings change, branding update

policy

policy create / update, approval grant / reject / expire

data

source connect, sync, document delete

admin

staff-mode actions (deactivate user, etc.)

See your first audit event in 5 minutes.

Get your MCP URL