--- title: Otto Support - Logging and Visibility in MCP Servers description: Most MCP servers log almost nothing beyond a tool name and timestamp, leaving attacks like SSRF, prompt injection, and supply chain compromise... canonical: https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Otto Support - Logging and Visibility in MCP Servers | daily.dev og:description: Most MCP servers log almost nothing beyond a tool name and timestamp, leaving attacks like SSRF, prompt injection, and supply chain compromise... og:url: https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm og:image: https://api.daily.dev/og/posts/M4ippwSRm.png og:image:alt: Otto Support - Logging and Visibility in MCP Servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Otto Support - Logging and Visibility in MCP Servers **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 8 min read · 0 upvotes · 0 comments ## Summary Most MCP servers log almost nothing beyond a tool name and timestamp, leaving attacks like SSRF, prompt injection, and supply chain compromise indistinguishable from routine activity in the logs. Using Bishop Fox's otto-support CTF lab, this piece compares a bare-bones default log against a full structured audit log, showing how the richer log surfaces an SSRF to an internal metadata endpoint that the minimal log completely misses. It ties this gap to the EchoLeak zero-click vulnerability in Microsoft 365 Copilot (CVE-2025-32711), industry survey data showing most organizations lack full visibility into agent actions, and the EU AI Act's Article 14 traceability requirements expected in August 2026. Even the verbose audit log has blind spots, such as a debug tool that logs no arguments and a password-reset tool that writes plaintext temporary passwords outside the logging pipeline. Recommended mitigations include structured audit logging via request hooks, destination classification for outbound requests, centralized SIEM shipping, and running MCP servers in containers without host mounts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was CVE-2025-32711 (EchoLeak) and why couldn't Microsoft's audit logs catch it? CVE-2025-32711 was a zero-click prompt injection vulnerability in Microsoft 365 Copilot, disclosed with a CVSS score of 9.3, where a crafted email or document caused Copilot to exfiltrate enterprise data including chat logs, OneDrive files, SharePoint content, and Teams messages without user interaction. Standard Microsoft 365 audit logs couldn't catch it because the exfiltration requests were indistinguishable from routine Copilot API calls. _See how daily.dev surfaces the latest coverage on AI agent vulnerabilities like prompt injection and exfiltration._ ### Why doesn't logging just the tool name and status catch an SSRF attack on an MCP server? Because a minimal log entry like tool=web_fetch status=ok looks identical whether the request went to a legitimate documentation URL or an internal metadata service. Without recording the actual URL, resolved destination, whether it was flagged internal, and whether auth tokens were forwarded, an SSRF to something like an internal metadata endpoint produces the exact same log line as a routine fetch, making detection impossible. _Developers hardening MCP tool calls can track emerging audit-logging patterns on daily.dev._ ### When does the EU AI Act's traceability requirement under Article 14 take effect and what does it require? The EU AI Act's Article 14 traceability requirements are expected to take effect in August 2026. Organizations deploying MCP-connected agents in high-risk categories will need to produce an audit trail of tool invocations, parameters, and outcomes, or face compliance exposure. _Teams preparing AI agent deployments for new compliance rules can follow related regulatory news on daily.dev._ ## Similar posts on daily.dev - [MCP Logging in Spring AI](https://daily.dev/posts/mcp-logging-in-spring-ai-qbbhsrn5t) · Baeldung · 2 upvotes · 0 comments - [We found that 1 in 5 MCP access policies came back broken or missing](https://daily.dev/posts/we-found-that-1-in-5-mcp-access-policies-came-back-broken-or-missing-5wsuhkppq) · The New Stack · 0 upvotes · 0 comments - [What CISOs need to know about new tools for securing MCP servers](https://daily.dev/posts/what-cisos-need-to-know-about-new-tools-for-securing-mcp-servers-5z1ny9azn) · CSO Online · 0 upvotes · 0 comments - [Where Apollo MCP Server Stands on the OWASP MCP Top 10](https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje) · Apollo Blog · 0 upvotes · 0 comments - [Securing MCP: How to Build Trustworthy Agent Integrations](https://daily.dev/posts/securing-mcp-how-to-build-trustworthy-agent-integrations-em5hvqqit) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#logging](https://daily.dev/tags/logging), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Otto Support - Logging and Visibility in MCP Servers","url":"https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm"},"datePublished":"2026-08-23T12:19:03.740Z","dateModified":"2026-08-23T12:30:43.876Z","description":"Most MCP servers log almost nothing beyond a tool name and timestamp, leaving attacks like SSRF, prompt injection, and supply chain compromise...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4db389c13bd7fea03ee17458ddd5e2e8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4db389c13bd7fea03ee17458ddd5e2e8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,logging,mcp,prompt-injection","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Otto Support - Logging and Visibility in MCP Servers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/otto-support---logging-and-visibility-in-mcp-servers-m4ippwsrm#faq","mainEntity":[{"@type":"Question","name":"What was CVE-2025-32711 (EchoLeak) and why couldn't Microsoft's audit logs catch it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2025-32711 was a zero-click prompt injection vulnerability in Microsoft 365 Copilot, disclosed with a CVSS score of 9.3, where a crafted email or document caused Copilot to exfiltrate enterprise data including chat logs, OneDrive files, SharePoint content, and Teams messages without user interaction. Standard Microsoft 365 audit logs couldn't catch it because the exfiltration requests were indistinguishable from routine Copilot API calls. See how daily.dev surfaces the latest coverage on AI agent vulnerabilities like prompt injection and exfiltration."}},{"@type":"Question","name":"Why doesn't logging just the tool name and status catch an SSRF attack on an MCP server?","acceptedAnswer":{"@type":"Answer","text":"Because a minimal log entry like tool=web_fetch status=ok looks identical whether the request went to a legitimate documentation URL or an internal metadata service. Without recording the actual URL, resolved destination, whether it was flagged internal, and whether auth tokens were forwarded, an SSRF to something like an internal metadata endpoint produces the exact same log line as a routine fetch, making detection impossible. Developers hardening MCP tool calls can track emerging audit-logging patterns on daily.dev."}},{"@type":"Question","name":"When does the EU AI Act's traceability requirement under Article 14 take effect and what does it require?","acceptedAnswer":{"@type":"Answer","text":"The EU AI Act's Article 14 traceability requirements are expected to take effect in August 2026. Organizations deploying MCP-connected agents in high-risk categories will need to produce an audit trail of tool invocations, parameters, and outcomes, or face compliance exposure. Teams preparing AI agent deployments for new compliance rules can follow related regulatory news on daily.dev."}}]} ```