Workspace logs
Agents get logged by the gateway. Humans get logged by the workspace. Workspace logs are the admin’s audit trail: a structured record of the actions that shape your workspace — who connected which repo, what scanned and when, and which security-relevant events fired — so “who did that?” is a lookup, not an investigation.
What gets recorded
Every entry is a typed event, captured automatically as people work. The record covers the workspace’s whole administrative surface:
Category | Events |
Connections | GitHub account connected via OAuth; repositories connected and disconnected |
Scans | Every scan's lifecycle: started, succeeded, or failed |
Security signals | Failed OAuth callbacks and detection of a revoked GitHub token — the early warnings that access is broken or was withdrawn |
Account lifecycle | Account deletion, so offboarding leaves a record |
Every event, fully attributed
A log line is only as useful as its context, so each entry carries the who, what, where, and from-where:
Field | What it tells you |
Actor | The workspace user behind the action |
Event type | The typed action, filterable — no free-text archaeology |
Target repository | Which connected repo the event touched, when one is involved |
Timestamp | When it happened, for timeline reconstruction |
IP & user agent | The request context — where the action came from and through what |
Details | Event-specific metadata attached to the entry |
Workspace log entries are retained for 90 days and then expire automatically — long enough for audits, reviews, and debugging, without accumulating an unbounded archive.
What admins do with them
- Audit. “Who connected the payments monorepo, and when?” is one filtered query — with the actor, the IP, and the timestamp attached.
- Security review. A revoked-token detection or a burst of failed OAuth callbacks is exactly the kind of quiet signal that predicts a louder incident. Here it is on the record, not lost in a server log.
- Debugging. Scans started failing Tuesday? The log shows every scan’s outcome in sequence, next to whatever changed around it.
The full observability picture
Workspace logs complete a three-layer story, each layer answering a different question:
Surface | What it records |
MCP insights and logs | Agent tool-call activity, results, and timing. |
Workspace logs | Supported workspace and administrative events. |
MCP webhooks | MCP tool-call events delivered to your receiver. Workspace audit events are not part of this webhook stream. |
This is what management-grade tooling means in practice: every actor in your workspace — human or agent — leaves a trail you can query, and none of it required setup.
Where to go next
On this page
- Workspace logs