MCP audit logs and rate limits

The specification tells servers to rate limit tool calls and tells clients to log tool usage for audit. It leaves the format to you. For each write, these fields answer most of the questions an incident raises:

Tool calls are half the record. The specification also suggests logging scope elevation, meaning what was requested and what was granted. Together with grants and revocations, that shows how an agent came to hold the access it used.

One limit for the whole server treats a search and a refund the same. Set limits per tool, starting from what a person doing that job would plausibly need, and give expensive or sensitive tools their own lower number.

Return a limit as a tool error with isError set and a clear message. The specification notes that clients should pass tool execution errors to the model, so the agent can read the message and adjust.

A rate limit slows a loop. A write cap ends it. Capping the writes in one run bounds how much an agent can change before a person looks, however slowly the calls arrive.

Protocol sessions no longer exist as of revision 2026-07-28, so a server on that revision needs its own definition of a run, such as a grant, a time window or a workflow handle.

Your API’s own limits still apply behind the server. Identify MCP traffic to your API so you can see it in your metrics, and so a busy agent spends its own budget and leaves the rest of that customer’s traffic alone.

The audit log records each write an agent attempted: the tool and request, its arguments, who sent it and from which client, whether the person approved it, and the status that came back. You can export it. It is kept for 12 hours on Free, 30 days on Starter, 90 days on Growth and 365 days on Business.

Cap writes per session stops a session after a set number of calls that change data. Cap calls per minute per tool slows any single tool, with per-tool limits for those that need their own number. Both apply on every plan.

Limits are checked before the approval prompt, so an agent over its cap is told so without asking the person anything.

Signed-in people are listed with the client they used and when it last made a call, and any grant can be ended from that list.