Workspace logs
Agents get logged by the gateway. Humans get logged by the workspace. Workspace logs are the admin’s audit trail: a structured record of the actions that shape your workspace — who connected which repo, what scanned and when, and which security-relevant events fired — so “who did that?” is a lookup, not an investigation.
What gets recorded
Every entry is a typed event, captured automatically as people work. The record covers the workspace’s whole administrative surface:
Category | Events |
Connections | GitHub account connected via OAuth; repositories connected and disconnected |
Scans | Every scan's lifecycle: started, succeeded, or failed |
Security signals | Failed OAuth callbacks and detection of a revoked GitHub token — the early warnings that access is broken or was withdrawn |
Account lifecycle | Account deletion, so offboarding leaves a record |
Every event, fully attributed
A log line is only as useful as its context, so each entry carries the who, what, where, and from-where:
Field | What it tells you |
Actor | The workspace user behind the action |
Event type | The typed action, filterable — no free-text archaeology |
Target repository | Which connected repo the event touched, when one is involved |
Timestamp | When it happened, for timeline reconstruction |
IP & user agent | The request context — where the action came from and through what |
Details | Event-specific metadata attached to the entry |
Workspace log entries are retained for 90 days and then expire automatically — long enough for audits, reviews, and debugging, without accumulating an unbounded archive.
What admins do with them
- Audit. “Who connected the payments monorepo, and when?” is one filtered query — with the actor, the IP, and the timestamp attached.
- Security review. A revoked-token detection or a burst of failed OAuth callbacks is exactly the kind of quiet signal that predicts a louder incident. Here it is on the record, not lost in a server log.
- Debugging. Scans started failing Tuesday? The log shows every scan’s outcome in sequence, next to whatever changed around it.
The full observability picture
Workspace logs complete a three-layer story, each layer answering a different question:
- MCP insights & logs — what agents did, per server, call by call.
- Workspace logs — what people did, across the workspace.
- MCP webhooks — either stream, pushed into your own systems as it happens.
This is what management-grade tooling means in practice: every actor in your workspace — human or agent — leaves a trail you can query, and none of it required setup.
Where to go next
MCP webhooks
Push MCP activity into Slack, your SIEM, or your warehouse instead of polling for it.
MCP insights & logs
The agent-side record: per-agent activity, per-tool health, and the call-by-call log.
On this page
- Workspace logs