Audit Trails Log What Agents Send. Almost None Verify What They Receive.

Markdown library not available. Raw content:

Every production MCP integration logs tool calls. The agent sends a request; it gets recorded. What almost no system logs — with any cryptographic binding — is what came back.

This is not a minor gap. Agent behavior is driven by responses, not requests. When an agent decides to send an email, update a database record, or escalate a ticket, that decision follows from what a tool returned. The logged call tells you what the agent asked. It says nothing verifiable about what the agent was shown.

## What Gets Logged vs. What Drives Behavior

A typical MCP audit trail contains:

- Timestamp of the tool call
- Tool name and version (usually from the client's perspective)
- Input parameters
- Sometimes: the agent's model version

What it rarely contains, with any integrity guarantee:

- The raw bytes of the tool response
- A signature proving those bytes came from the declared tool server
- A binding between the specific call and the specific response
- Proof that the response arrived within an expected time window

The response is logged, if at all, as a field in the same record as the call. There is no cryptographic link between the two. A tampered response is indistinguishable from a legitimate one in the audit trail.

## Why This Creates a Real Attack Surface

Consider a production agent with read access to a customer database and write access to a CRM. The agent calls a lookup tool, gets back a customer record, and uses that record to update the CRM. Standard flow.

Now consider the same flow with a tampered lookup response. The agent still logs a legitimate call to the lookup tool. The response in the log is whatever was received. If the response was modified in transit — or substituted by a compromised tool process — the agent's downstream write action looks fully authorized in the audit trail. The call was real. The authorization was valid. The response was not.

This is not a theoretical vector. MCP tool processes run as separate services. They can be updated in