How long should audit logs be retained?

It depends on the applicable framework and your own policy; check current DPDP, RBI, and any sector-specific retention requirements rather than assuming a fixed number, since retention rules change.

Should audit logs be encrypted?

Yes, both at rest and in transit, and ideally with separate keys from your general application data.

Can audit logs be edited?

No. Use append-only, versioned storage so an entry can be added but never silently altered or deleted.

complianceHowTo

MCP Audit Logging Implementation

Buffer, batch, and durably store immutable audit log entries for every MCP tool invocation, plus how to query and report on them.

Quick Answer / TL;DR

Log every tool invocation locally for immediate visibility, buffer entries in memory, and flush them in batches to durable, encrypted, append-only storage such as versioned S3. This guide covers the implementation architecture; see the DPDP checklist for what a compliant log entry needs to contain.

Key Takeaways

Buffer and batch-flush audit entries rather than writing one object per request, to control storage cost and I/O.
Store audit logs in append-only, encrypted storage separate from application logs.
Build a query and reporting path from day one — an audit log nobody can query does not satisfy an access or compliance request.

Buffered, durable writes

Log locally for immediate operational visibility, but batch entries and flush them periodically to durable storage rather than writing one small object per tool call, which gets expensive and slow at volume.

typescript

class AuditLogger {
  private buffer: AuditLogEntry[] = [];
  constructor(private flushEveryMs = 10000, private flushAt = 100) {
    setInterval(() => this.flush(), this.flushEveryMs);
  }

  log(entry: AuditLogEntry) {
    this.buffer.push(entry);
    if (this.buffer.length >= this.flushAt) this.flush();
  }

  private async flush() {
    if (!this.buffer.length) return;
    const batch = this.buffer.splice(0, this.buffer.length);
    const key = `audit-logs/${new Date().toISOString().slice(0, 10)}/${Date.now()}.json`;
    await s3.send(new PutObjectCommand({
      Bucket: "mcp-audit-logs", Key: key,
      Body: JSON.stringify(batch), ServerSideEncryption: "AES256",
    }));
  }
}

Querying and reporting

An audit log that cannot be queried does not satisfy a data-access or compliance request. Build a report that at minimum answers: how many calls, by whom, with what success rate, and how many were flagged as errors or blocked.