Monitor Appian MCP Server

System administrators can monitor Appian MCP Server activity using audit logs. This page describes how to enable audit logging, what MCP activity is captured, and how to filter log entries by authentication type.

Enable MCP audit logging

MCP requests are not logged by default.

To start recording Appian MCP Server activity:

1. Enable the Appian MCP Server.
2. In the Admin Console, go to Logging.
3. Select the Appian Platform API trace logging checkbox.
4. Click SAVE CHANGES.

View Appian MCP Server audit logs

Appian MCP Server activity is recorded across two logs:

• Platform API trace log (appian_platform_api_trace.csv): Records the platform API endpoint, timestamp, username, authentication type, and request outcome. Use this log to trace which endpoints MCP tools accessed.
• OAuth 2.0 Authorization Code grant audit log (oauth_authorization_code_grant_for_inbound_requests.csv): Records OAuth 2.0 client management, sign-in, and access and refresh token issuance. Use this log to trace MCP activity by user.

Appian MCP Server writes trace logs to the <APPIAN_HOME>/logs/perflogs/ directory.

Monitor MCP tool call activity

The appian_platform_api_trace.csv file captures all platform API calls, including those initiated by Appian MCP Server.

When Platform API trace logging is enabled, the following MCP activity is captured:

• Data fabric queries against synced record types.
• Process model invocations started through MCP.
• Expression rule evaluations triggered by external AI applications.
• AI agent invocations initiated through MCP.

The log entry records the platform API endpoint, not the name of the MCP tool that triggered the request. To identify MCP requests, filter the Client ID column by customer-mcp-server. These requests have the Auth Type of token_exchange. Each MCP connection also makes a token request (POST /auth/token) with the Auth Type of api_key and no username.

Monitor OAuth 2.0 requests

Requests authenticated with OAuth 2.0 are recorded in the OAuth 2.0 Authorization Code grant audit logs. The following authentication activity is captured:

• Access token issuance and usage for MCP requests.
• Failed authentication attempts, including expired tokens, missing scopes, and group restrictions.

The log does not record the specific MCP tools called or endpoints accessed. It does not record the token exchange that serves each MCP request, the MCP tools called, or the endpoints accessed.

Use the runtime request log (audit/oauth_authorization_code_grant_for_inbound_requests.csv) to trace MCP activity by user:

• Find requests by user: Filter the User column to see every request made on behalf of a specific signed-in user.
• Find requests by tool or agent: Filter the Actor column to see which tool or agent acted on the user's behalf.
• Find requests by client: Filter the Client ID column to see all activity for a registered authorization code client.
• Diagnose failures: Filter the Result column for FAILURE, or look for ACCESS_TOKEN_DENIED and AUTH_FAILED events, to investigate rejected requests such as a missing scope, an audience mismatch, an expired token, a deactivated client, or a group restriction. For details on how Appian enforces permissions on MCP connections, see Appian MCP Server Security.

Feedback