The Audit Management server lets AI agents browse IDMC audit and security logs.
This MCP server enables your AI agents to browse the organization-wide audit trail of who created, edited, deleted, exported, published, or ran which asset. It also allows your AI agents to retrieve security logs and identity events such as logins, logouts, multi-factor authentication (MFA) changes, password resets, and user, role, and group changes.
The Audit Management MCP server is strictly telemetry for compliance and security investigation. The server only reads recorded events. The server never creates, modifies, or deletes any asset, user, or configuration.
Key capabilities
This MCP server offers the following key capabilities:
•Organization audit trail. Browses the IDMC audit log of create, edit, delete, export, publish, and run actions taken across assets such as connections, agents, taskflows, schedules, and users.
•Scoped event filtering. Narrows the security log by time window, actor, action category, or object name. Pages through both the audit and security logs in batches.
•Security and identity event retrieval. Retrieves security log entries for logins, logouts, multi-factor authentication (MFA) enablement, password resets, and changes to users, roles, groups, and privileges.
•Actor attribution. Reports the acting username, the target object name and ID, and both local and UTC timestamps for every recorded event, supporting precise accountability.
Use cases
Use this MCP server to address the following use cases:
•Compliance reporting. Retrieve the audit trail for a date range to summarize who created, modified, deleted, or exported which assets for a compliance or audit report.
•Access and privilege review. List recent user, role, group, and privilege changes to confirm that access grants and administrator-role assignments were authorized.
•Security incident investigation. Query the security log for failed multi-factor authentication (MFA) verifications, password resets, or logins by a specific actor within a time window to investigate suspicious activity.
•Change attribution. Trace a specific asset through the audit log to identify who last edited, published, or deleted it and when.
Tools
The following table describes the tools available on this MCP server:
Tools
Description
search_audit_log
Browses the audit log. Each entry captures the acting user, the object affected, and timestamps in both Eastern (ET) and UTC time. The category parameter classifies the audited object domain. The event parameter classifies the action performed.
Do not include parameters to view the most recent 200 entries. Include batchId and batchSize parameters to page through results, where batchId 0 is the most recent batch. For example, batchSize 25 with batchId 1 returns entries 26-50.
search_security_log
Browses security log entries. The following are security log entries:
- Login and logout actions
- Multi-factor authentication (MFA) enable, disable, and verification events
- Password resets
- Creation, update, and deletion of users, user groups, and roles
Do not include parameters to view security log entries from the previous 24 hours with a maximum of 200 entries.
You can include an RSQL-style q filter that joins any of the following conditions with ';' (AND):
- entryTime. A UTC range spanning at most 14 days.
- actionCategory
- actor
- objectName
Any q field other than entryTime requires an entryTime range.
Use skip and limit parameters to page through larger result sets. The default skip is 0. The default limit is 200. The limit range is between 100 to 1000.
The search_security_log tool has read-only access to logs. This tool never creates, modifies, or revokes users, roles, or access.
Note:
In AI Agent Engineering, the MCP server tools are called "actions."