MCP Server Logs
The Kron PAM MCP Server exposes Kron PAM log data to artificial intelligence (AI) clients through the Model Context Protocol (MCP). The server grants governed, read-only access, so an AI client queries and analyzes log records but never changes data in Kron PAM. The server also filters every query by the portal functions of the requesting user, so users reach only the data that their roles permit.
The MCP Server exposes structured query endpoints for the log types listed in the following table.
Table 1. Log Sources Available Through the MCP Server
Log Source | Content |
|---|---|
User Authentication Logs | Login attempts and authentication results for Kron PAM users. |
Session Logs | Privileged sessions, including their start times, end times, and target devices. |
HTTP Proxy Logs | Requests that pass through the Kron PAM HTTP proxy. |
Activity (Event) Logs | Commands and events that users run during their sessions. |
TACACS+ and RADIUS Accounting Logs | Accounting records that network devices send to Kron PAM. |
Kron PAM writes every MCP request to a separate audit trail, which administrators and auditors review on the MCP Server Logs page.
An administrator assigns the kronpam.mcp.server.logs.moduleVisibility portal function to the users who review MCP requests and responses. Without this portal function, the MCP Server Logs page stays hidden.
To review the MCP requests:
1. Log in to the Kron PAM Web GUI.
2. Navigate to Logging > MCP Server Logs.
3. Set the filter fields, then click the Search button to list the records.
The following table describes the columns of the page.
Table 2. Columns of the MCP Server Logs Page
Column | Description |
|---|---|
MCP Log Type | The type of the record, such as a session start or a tool call. |
Log Details | The details of the request. Click a truncated value to open the full text in a modal. |
Timestamp | The date and time of the request in your local time zone. |
Username | The user account that sent the request. |
Tool Name | The MCP tool that the client called. |
Actions | The available operations for the record, such as opening the request details. |
Kron PAM records three types of MCP entries.
Table 3. MCP Log Types
Log Type | Description |
|---|---|
MCP_SESSION_START | The client opened an MCP session. |
MCP_PROTOCOL | The client and the server exchanged a protocol message. |
TOOL_CALL | The client called an MCP tool, such as a log query. |
Use the filter panel to narrow the results by a time range, a user, a tool name, or a log type.