borisdan/mcp-audit-extension

Audit and log all GitHub Copilot MCP tool calls in VSCode with ease.
## Table of Contents
Overview
Key Use Cases
Installation
From the Command Line
From the Visual Studio Code UI
Usage
Configuration
Log Data Format
Limitations
Troubleshooting
FAQ
License
Contact
## Overview
The MCP Audit extension for Visual Studio Code provides essential visibility into the MCP tools and commands executed by GitHub Copilot. As AI Copilots become more integrated into development workflows, the ability to audit their actions is critical for security, compliance, and operational insight.
This extension transparently intercepts and logs all MCP tool calls, forwarding them to your preferred SIEM, centralized logging platform, or a local file.
## Key Use Cases
Security & Compliance Audits: Create a comprehensive audit trail of all MCP tool calls performed by GitHub Copilot, ensuring compliance with audit requirements and identifying potential security risks.
Centralized Logging: Aggregate MCP tool usage data from all developers into a central location (e.g., Splunk, Syslog), allowing AI, security, and IT teams to analyze trends and manage AI usage effectively.
Developer Troubleshooting: Provide developers with detailed logs of Copilot's tool interactions for easier debugging and a better understanding of its behavior.
Your browser does not support the video tag.
## Installation
> Note: This extension requires Visual Studio Code version 1.101 or newer.
MCP Audit is built for enterprise environments and is fully manageable via MDM or other configuration management tools, using the CLI. The deployment process involves two steps: installing the extension and pushing a centralized configuration file. Deployment on individual machines using the Visual Studio Code UI is available as well.
### From the Command Line
Install the extension directly from the marketplace using the appropriate command for your operating system.
shell
code --install-extension mcp-audit-extension
### From the Visual Studio Code UI
1. Open Visual Studio Code.
2. Navigate to the Extensions view (Ctrl+Shift+X).
3. Search for "MCP Audit".
4. Click Install.
## Usage
Upon installation, the extension automatically identifies all configured MCP servers in your VS Code settings. For each original server, it creates a mirrored (tapped) version.
To enable auditing, you must use these (tapped) servers. GitHub Copilot will indicate that new servers are available via a blue refresh icon in the chat panel's agent mode selector. Simply start the tapped servers when prompted.
The extension also adds a new view to the Explorer sidebar called MCP Audit Log. This view displays the last tool calls that have been logged, providing a quick and convenient way to review recent activity. This feature depends on the default file logger being enabled.
View icon:
Any changes made to the original MCP server configurations, including the addition of new ones, will be automatically reflected in their corresponding tapped versions.
> Note: Auditing is only active when at least one log forwarder (HEC, Syslog, or File) is enabled in the extension's settings and you are using a (tapped) MCP server.