MCP Audit Extension

What it is

The MCP Audit Extension (VS Code) for auditing GitHub Copilot MCP tool calls. The summary covers what it does; the page reveals the two things that decide whether it actually works as a control: auditing is trivially bypassable, and secret distribution passes through a plaintext file on disk.

How it works

On install, the extension reads your configured MCP servers and creates a mirrored "(tapped)" copy of each. Copilot signals the new servers with a blue refresh icon in the agent-mode selector, and the developer must manually start the tapped versions. Only traffic through tapped servers is logged. An "MCP Audit Log" view in the Explorer sidebar shows recent calls, but only if the default FILE logger is enabled.

Preconditions / Affected

• Requires VS Code 1.101 or newer.
• Auditing is active only when (a) at least one forwarder (HEC/Syslog/File) is enabled and (b) the developer is using a tapped server. If a developer keeps using the original (untapped) servers, nothing is logged. Nothing forces the switch — this is an opt-in per user action, not an enforced interception.

What to do

Install via marketplace:

code --install-extension mcp-audit-extension

For enterprise/MDM: install the extension, then push a centralized settings.json defining mcpAudit.forwarders (an array; multiple destinations allowed simultaneously). Forwarder types are HEC, CEF (Syslog), and FILE.

For HEC secrets, do not put tokens in settings. Pre-stage a mcp-tap-secrets.json before install, keyed to match tokenSecretKey:

{ "prod-hec-token": "YOUR-SECRET-HEC-TOKEN-VALUE" }

Placement by OS:

• Windows: %APPDATA%\Code\User\mcp-tap-secrets.json
• macOS: ~/Library/Application Support/Code/User/mcp-tap-secrets.json
• Linux: ~/.config/Code/User/mcp-tap-secrets.json

On first launch the extension moves the token into VS Code encrypted secret storage and deletes the file.

Caveats

• The secret sits in cleartext on disk until the next VS Code launch reads and deletes it. Anything reading the config directory in that window (backup agents, other users, snapshots) captures the HEC token. Treat the staged file as a live credential.
• This is a visibility tool, not an enforcement control. Because it depends on the developer choosing the tapped server, a user (or malicious insider) can bypass all logging by simply using the original server. Do not treat its logs as a complete record.

flowchart TD
    A[Copilot MCP call] --> B{Which server?}
    B -->|tapped| C{Forwarder enabled?}
    B -->|original| D[No log — bypassed]
    C -->|yes| E[Logged to SIEM/file]
    C -->|no| D