---
title: MCP Gateway Logs
slug: kronpam-reference-guide-3-9-0/A3dC-mcp-gateway-logs
docTags: 
createdAt: 2026-10-14T14:14:07.407Z
---

The Kron PAM MCP Gateway controls the traffic between AI clients and the external MCP servers that your organization registers. The gateway forwards a request only when a Realm authorizes the user for the target MCP server.

Kron PAM writes every gateway event to a separate audit trail, which administrators and auditors review on the **MCP Gateway Logs** page. For the gateway configuration, please refer to Kron PAM MCP Gateway section.

The **MCP Gateway Logs** page requires the kronpam.mcp.gateway.logs.moduleVisibility portal function. Without this portal function, Kron PAM hides the page.

To review the MCP Gateway Logs:

1. Log in to the Kron PAM Web GUI.
2. Navigate to **Logging** > **MCP Gateway Logs**.
3. Enter a search term or set the filter fields to list the records.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/AgN2jUVdAYhpctA300IFl_mcp-gateway-logs-1.png)

The MCP Gateway Logs page contains the columns listed in the following table.



| Column          | Description                                                                                |
| --------------- | ------------------------------------------------------------------------------------------ |
| Timestamp       | The date and time of the event in your local time zone.                                    |
| Username        | The Kron PAM user of the gateway session.                                                  |
| MCP Server Name | The MCP server of the request.                                                             |
| MCP Server URL  | The upstream URL of the MCP server.                                                        |
| Source IP       | The IP address of the AI client.                                                           |
| Session ID      | The gateway session. All events of a session share the same value.                         |
| Method          | The MCP method of the request, such as tools/call.                                         |
| Tool            | The tool that the AI client called.                                                        |
| Event Type      | The type of the event.                                                                     |
| Outcome         | The result of the event, such as ALLOW for a Realm decision or LOGGED\_OUT for a sign-out. |
| Actions         | Opens the MCP Request Details modal of the event.                                          |
|                 |                                                                                            |

Kron PAM records the MCP Gateway event types listed in the following table. For a single tool call, the gateway writes REALM\_DECISION, MCP\_REQUEST\_FORWARDED, and MCP\_RESPONSE\_RETURNED records in this order.



| **Event Type**                | **Description**                                                               |
| ----------------------------- | ----------------------------------------------------------------------------- |
| REALM\_DECISION               | The gateway evaluated the Realms. The **Outcome** column shows ALLOW or DENY. |
| MCP\_REQUEST\_FORWARDED       | The gateway forwarded an allowed request to the MCP server.                   |
| MCP\_RESPONSE\_RETURNED       | The MCP server returned a response to the gateway.                            |
| USER\_LOGOUT                  | The user ended the session with the gateway\_logout tool.                     |
| AUTH\_CHALLENGE\_ISSUED       | The gateway asked the user to sign in.                                        |
| AUTH\_SUCCESS / AUTH\_FAILURE | The sign-in succeeded or failed.                                              |

Click the icon in the **Actions** column to open the **MCP Request Details** modal. For an MCP\_REQUEST\_FORWARDED record, the modal shows the tool name and its arguments. For an MCP\_RESPONSE\_RETURNED record, the modal shows the content that the MCP server returned.