ProjectBuild a Permission-Aware Knowledge Hub as an MCP Server: the explanation · Module 14: The audit log and redaction · part 16 of 22
Part 16 · Module 14: The audit log and redaction
Module 14: The audit log and redaction
25 min read·
About 40 minutes · Needs: Module 7 (groups, visibility and who can read what), Module 11 (the tools and errors as results), Module 13 (create_issue and its confirm statuses) · Code: server/wayfinder/audit.py, server/wayfinder/mcp/server.py, server/wayfinder/api/routes.py, console/src/pages/Audit.tsx
Where this fits
The parts this module covers (blue): the audit log the MCP layer writes on every tool call, the console API and page that read it back, and the access rules that decide what each reader may see in a row.
Every tool call that reaches Wayfinder, from any client, leaves one row in the audit log. This module follows a row from the moment it is written in the MCP layer to the moment a lead, a security engineer or a VP reads it in the console, and shows the rule that was added after a security review: being allowed to see a row is not the same as being allowed to read what it touched.
The rest of this project is yours to keep
This project is bought on its own, once, and stays readable afterwards, including the parts added to it later.