MCP server capabilities and the audit log

When Intric connects to an MCP server, it finds out what the server can do: a list of its tools, which the platform calls capabilities. On the Capabilities page you decide, for each capability, whether it can run at all and whether someone has to approve each run. That setting also decides what the audit log records later. Some choices leave a record of every run, and others leave none.

Only organization Admins can change these settings. For setting up a server in the first place, see Connecting your own MCP server to Intric. For how approval modes fit in with the other AI tools, see AI tools.

Finding the Capabilities page

1. Go to Admin → AI Tools and open the MCP tab.
2. Open the MCP server.
3. Under Features & Permissions, click Capabilities.

The row shows a summary before you open it, such as 12 tools · 3 automatic. If it says Not fetched, Intric has not read the server’s list yet. Use Refresh capabilities to fetch it.

Shown here for the Outlook integration. The Capabilities page of an MCP server works the same way.

Approval modes

Each capability is listed by name, with the description the server provides. Neither can be edited in Intric, because both come from the server. Next to each one is a switch with three positions:

Mode	What happens in a conversation
Off	The assistant is not told the capability exists, so it cannot use it.
Ask	Before every run, the user sees what the assistant wants to send to the tool, and chooses Approve or Deny.
Auto	The capability runs straight away, with no question to the user.

Letting users approve for themselves

With Ask selected, you can also tick Users can enable auto-approval. The approval card then gets two more options:

• Always allow for this assistant: the capability no longer asks this user when they chat with this particular assistant.
• Always allow everywhere: the capability no longer asks this user in any of their conversations.

The user has to confirm the choice first, and the choice only applies to that user. Runs covered by it are marked Auto-approved in the conversation.

Note: A user cannot yet take back an auto-approval once they have given it. As an admin, you can stop all such approvals for a capability by setting it to Ask without the checkbox, or to Off. The approvals are kept, though, and start working again if you tick the checkbox again.

Working with many capabilities

• Search and the All / Off / Ask / Auto filter help you find a capability. The line above the list counts how many are in each mode.
• Set all to Off / Ask / Auto changes every capability on the server. It ignores any search or filter you have applied.
• Nothing takes effect until you save. Done takes you back to the server panel, and there you click Save changes. Revert undoes changes you made on the Capabilities page.

Defaults and things to be aware of

• New capabilities start on Ask. The exception is a capability the server itself marks as not needing permission. That one starts on Auto.
• Turning the server on resets every capability to its default. If you turn an MCP server off and then on again, any capabilities you set yourself go back to their defaults. Check the Capabilities page after turning a server back on.
• Settings can only be changed while the server is on.
• If nothing is left on, the server turns itself off. Setting every capability to Off can switch the whole server off.
• Settings follow the capability’s name. If the server renames a tool, Intric treats it as a new capability that starts on its default. If a capability disappears and later comes back under the same name, it gets its old setting again.
• Resources and prompts aren’t listed. An MCP server can offer more than tools: resources (content the assistant can read) and prompts. Intric uses them, but they don’t appear on this page. They run automatically unless the server marks them as needing permission.
• The mode is the same everywhere. No Space or assistant can override a capability’s mode. Assistants add or remove the whole server, and security classification also applies to the whole server, not to single capabilities.

Refreshing capabilities

Refresh capabilities asks the server for its current list and replaces the one stored in Intric. Intric also refreshes by itself when you save a new server URL, or when you connect an OAuth account. The button is unavailable in three cases:

• the server is turned off
• the server panel has unsaved connection changes
• the server uses OAuth and you have not connected your account

How settings show up in the audit log

The audit log shows each entry under its technical event name, for example TOOL_UPDATE. For the full details of an entry, open it: you’ll see its data, which is also included in the CSV export.

Changing the settings

When you save changes on the Capabilities page, the log records one TOOL_UPDATE entry. The same event is used when you change whether the server is available to the organization, or change its security classification.

• Actor: the admin who saved.
• Resource: type MCPTool. The resource name is always mcp, not the server’s name, so use the Resource ID to tell servers apart.
• Details: the old and new values of whatever changed. A capability setting looks like this:

"llm_tool_settings": { "items": { "search_documents": "auto_approve" } }

The value stored for each mode:

On the Capabilities page	In the audit log
Off	denied
Ask	ask
Ask + Users can enable auto-approval	consent_allowed
Auto	auto_approve

Changes to the server itself are logged separately. MCP_SERVER_CREATE, MCP_SERVER_UPDATE and MCP_SERVER_DELETE have the server’s name as the resource. MCP_SERVER_UPDATE records which fields changed (for example the URL, or credentials for an API key or client secret), but not the new values.

Running capabilities

The mode decides what is recorded each time an assistant uses a capability:

Mode	What the user did	Logged as
Off	—	Nothing. The capability can’t run.
Ask	Clicked Approve	TOOL_USE_APPROVE
Ask	Clicked Deny, or sent a new message instead of answering	TOOL_USE_REJECT
Ask + users can enable auto-approval	Chose Always allow for this assistant or Always allow everywhere	TOOL_AUTO_APPROVE_CONSENT_GRANT and TOOL_USE_APPROVE
Ask + users can enable auto-approval	Nothing: the run was covered by an earlier “always allow”	TOOL_USE_AUTO_APPROVE
Auto	Nothing. The capability ran without asking.	Nothing

The approve, reject and auto-approve entries are linked to the conversation, and they record the capability’s name and exactly what the assistant sent to it. They don’t record the server’s name or what the tool sent back. TOOL_AUTO_APPROVE_CONSENT_GRANT records whether the approval covers one assistant or everywhere, and which assistant.

Note: TOOL_USE_AUTO_APPROVE and TOOL_AUTO_APPROVE_CONSENT_GRANT appear in the log, but the event filter doesn’t list them yet. To find them, filter by user or date range, or search the CSV export.

What is not logged

• Runs of capabilities set to Auto, and runs of resources and prompts that run automatically.
• Approvals and denials inside plan runs. An “always allow” given there is still logged.
• Refresh capabilities, whether you started it or it ran by itself.
• Connecting or disconnecting an OAuth account, and connection checks.
• What the tool sent back.

If you need a record of every run of a capability, use Ask, not Auto. Ask with Users can enable auto-approval still records every run, but after a user’s first “always allow”, that user’s runs are logged as TOOL_USE_AUTO_APPROVE instead of an approval.