Skip to main content
MCP Gateway is available on Portkey Cloud. For the complete observability reference, see portkey.ai/docs/product/mcp-gateway.

​
What gets logged

The MCP Gateway logs every tool call that passes through it. Each log entry captures:
FieldDescription
timestampWhen the tool call was made (UTC)
request_idUnique identifier for the request
userAuthenticated user who made the call
teamTeam the user belongs to
serverMCP server the tool call was routed to
toolName of the tool that was called
paramsParameters passed to the tool
responseResponse returned by the tool
statussuccess, error, or denied
latency_msEnd-to-end latency in milliseconds
errorError message if the call failed
Denied requests (blocked by access control) are also logged with status: denied, giving you a complete audit trail of both successful and rejected calls.

​
Viewing logs in the Portkey dashboard

The Portkey dashboard provides a real-time log viewer for all MCP tool calls in your workspace:
  • Live feed — new tool calls appear as they happen
  • Search and filter — filter by user, team, server, tool name, status, or time range
  • Request detail — click any log entry to see the full parameters and response
  • Latency charts — visualize latency trends per server or tool

​
Log structure

Logs are structured JSON. Each tool call produces an entry like:
example log entry
{
  "timestamp": "2024-01-15T14:32:01.234Z",
  "request_id": "req_01j8abc123xyz",
  "user": "alice@example.com",
  "team": "engineering",
  "server": "github",
  "tool": "search_repositories",
  "params": {
    "query": "portkey-ai",
    "limit": 10
  },
  "response": {
    "repositories": [
      { "name": "gateway", "stars": 10998 }
    ]
  },
  "status": "success",
  "latency_ms": 312
}

​
Exporting logs

Logs can be exported from the Portkey dashboard in JSON or CSV format, or forwarded in real time to external observability platforms (Datadog, Splunk, Grafana Loki, and others) via webhook integrations configured in the dashboard.

​
Alerting

Use any log-based alerting system with exported logs. Common alerts to configure:
  • High error rate — more than X% of tool calls returning errors in a time window
  • Denied requests spike — unusually high number of access-denied events (potential credential misuse)
  • Latency degradation — latency exceeding a threshold for a given server
  • Unexpected tool access — a specific sensitive tool being called unexpectedly
Denied request logs include the user, team, server, and tool that was blocked — useful for auditing and detecting unauthorized access attempts.

​
Learn more

Build docs developers (and LLMs) love

Get started for freeTalk to us