audit
Every call logged
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain audit.
- pack
db- weight
- advisory · not scored
- scope
- server
- decided by
- response
- since
- 0.1-draft (methodology 0.3-draft)
- config keys
checks.audit.enabledchecks.audit.severity
Probes
This check makes no probe in methodology 0.3-draft: it is listed, reported as not measured, and never scored.
Settings and thresholds
Every check also takes checks.audit.enabled and checks.audit.severity; they are described once in the configuration reference.
This check has no numeric threshold.
How the verdict is established
- Scoring. advisory: reported with its verdict but not part of the score.
What to fix
Write an audit record for every tool call (who, which tool, when). This check is not measured and always reports n/a.
False positives
Not measured in methodology 0.2: servers do not write audit rows by themselves, so there is nothing to compare against.
False negatives
Always n/a today.
Notes
This check is listed so that no report implies audit logging was tested. It was not.
The harness makes no call and reads no state for it. The result is always n/a with the reason "not measured in methodology 0.3-draft: servers do not write audit rows by themselves", with no evidence line and no verifiedBy value.
A database MCP server does not usually write audit rows of its own accord, so there is nothing in the seed for the harness to read back. Until a defined, checkable form of "logged" exists, the honest answer is that it was not measured. The check is advisory, so it never contributes to a grade either way.
Limits#
It never fails, so there is no false positive, and the false negative is total: a server with no logging and a server with perfect logging both read n/a. Audit logging also appears in the "Not covered" list of every text report and in the known blind spots.