Story (Required)

This spike explores the audit logging requirements for MCP (Model Context Protocol) clients interacting with RHDH's MCP server, leveraging Backstage's existing Auditor Service infrastructure. The goal is to determine if current audit capabilities are sufficient for tracking AI tool usage, data access patterns, and security-relevant events, or if upstream contributions are needed to enhance MCP audit functionality.

Background (Required)

RHDH includes a comprehensive Auditor Service designed to record security-relevant events with standardized categorization, severity levels, and detailed metadata. MCP clients will interact with the MCP server to access various tools and data sources, potentially involving sensitive operations that require audit trails for compliance and security monitoring. We need to understand what audit events are currently captured during MCP interactions and determine if additional logging capabilities are needed to meet enterprise security requirements.

Out of scope

Implementation of production audit logging solution for any MCP plugins delivered in 1.8. This item as it stands (investigation and potential upstream contribution) is considered a stretch goal for 1.8.

Approach (Required)

1. Analyze current MCP server implementation for existing audit logging capabilities
2. Map MCP client interactions to Backstage's Auditor Service event types
3. Investigate audit log retrieval mechanisms from MCP server and tools
4. Identify gaps in current audit coverage for MCP operations
5. Design audit event schema for MCP interactions following Backstage conventions:
```json
{
"eventId": "mcp-tool-execution",
"meta":

{ "actionType": "execute", "toolName": "string", "clientId": "string", "dataAccessed": "boolean", "sensitivityLevel": "low|medium|high" }

,
"severityLevel": "medium"
}
```
6. Reference Backstage Auditor Service conventions from https://backstage.io/docs/backend-system/core-services/auditor/_

Dependencies

Access to MCP server implementation, understanding of Backstage Auditor Service, enterprise compliance requirements documentation, MCP protocol specification

Acceptance Criteria (Required)

1. Complete audit trail mapping for all MCP client-server interactions
2. Documented log retrieval process from MCP server and tools
3. Identified gaps and recommendations for upstream MCP protocol enhancements
4. Prototype audit event implementation following Backstage naming conventions (kebab-case event IDs, structured meta fields)

Done Checklist

Code is completed, reviewed, documented and checked in
Unit and integration test automation have been delivered and running cleanly in continuous integration/staging/canary environment
Continuous Delivery pipeline(s) is able to proceed with new code included
Customer facing documentation, API docs, design docs etc. are produced/updated, reviewed and published
Acceptance criteria are met
If the Grafana dashboard is updated, ensure the corresponding SOP is updated as well