AuditTrailInterceptor

Rasuvaeff\Yii3McpAuditLogBridge\AuditTrailInterceptor

Class — Rasuvaeff\Yii3McpAuditLogBridge — Source

Records every MCP tools/call into the audit trail: who called, which tool, the arguments, the outcome and the duration.

WHO is decided by an AuditActorResolverInterface. The default ClientAuditActorResolver credits the MCP connection (session id + handshake client name); an authenticated endpoint binds a resolver that credits the user, which is the only way the journal still answers "which user did what" after the session store dropped the session. Either way the connection itself is recorded as mcp.session / mcp.client / mcp.client_id, so it is never lost.

Each tool argument becomes its own change field, so the AuditLogger's SensitiveValueMasker masks arguments named password, token etc. the same way it masks any other audited value. Call metadata fields are prefixed with mcp. to stay clear of argument names.

mcp.outcome follows the core's shared CallOutcome vocabulary: success, rejected (a client-visible refusal — rate limit, RBAC, budget, or the tool itself throwing ToolCallException) or error (an unexpected failure). The interceptor never swallows failures: the exception is recorded and rethrown, so the MCP error envelope the agent sees is unchanged.

Methods

intercept()

intercept(Interceptor\ToolCallContext $context, callable $next): mixed