Agent audit

What can you do with it?

• See, per agent, each tool it called, whether it succeeded, failed or was rejected, whether it modified data, on which ids and how long it took.
• See an agent's long operations in progress and a summary of the last 24 hours.
• Know whether an agent is working right now (activity in the last 2 minutes).
• Read a VPS shell command history: who ran each command and which human authorized the agent.
• Find in the VPS and project activity logs what an agent did, under its name and its human's.

When should you use it?

• Reviewing what an agent did while nobody was watching.
• Understanding why an agent says it could not do something (rejections are recorded with their reason).
• Spotting a forgotten agent that keeps renewing its session without working.

How does it work in ArduMaker?

Call log

Each tool call (except ping, which has no authentication) is written once, when it ends, with everything known about it. The audit wraps the other guards: a rejection for read-only scope or for the call limit is written too.

Commands on a VPS

• Each ejecutar_comando_vps leaves a generic line in the VPS activity log (“Shell command executed”) and the detail in the command history.
• The history stores the command (with labelled secrets, such as password= or PGPASSWORD=, masked), the directory, the exit code, the duration, the start of the output, who ran it and, if it was an agent, which human authorized it. Commands rejected by a guard are included too.
• It is kept for 30 days, on purpose: masking does not recognise a bare credential with no label, so the time it could stay stored is kept short.

On whose behalf

An agent acts with its own user linked to the person who authorized it. In the VPS and project activity logs, its actions appear under the agent with its human next to it. Dedicated tools record the detail that matters: deleting a Linux user writes the deleted name, and revealing an app credential is audited without the value.

What actually changes?

Querying activity writes nothing new: it reads what was already recorded.

Diagram

Expected result

• In /me, an agent's activity returns llamadas (30 per page, up to 100, paged backwards), and on the first page operaciones, resumen_24h (total, ok, error, rechazo, escrituras), trabajando, esta_activa and ultima_actividad.
• Each connection shows refresh_count and ultima_actividad: many renewals with old activity reveal a forgotten agent.
• reuse_detected_at with a date means an already redeemed refresh token was reused; the session was already revoked automatically.

Errors and troubleshooting

• A very short call does not show while it runs (it lasts milliseconds); what really takes time shows in operaciones.
• An operation's state in the list is the last known one: for the current one, use ver_operacion.
• Calls recorded before the field existed have modifica_datos: null: unknown, it does not mean “read”.
• Viewing someone else's connection activity answers 404, not 403.

MCP access

Agent activity is viewed in /me; there is no MCP tool to read the call log. From an agent, these can be read:

• ver_historial_comandos_vps: a VPS's commands (read, up to 200 per page; useful to avoid repeating something already tried).
• ver_logs_proyecto: a project's activity history (read).
• ver_operacion: the status and result of a long operation.

Reference at /mcp/docs.

Related features

• MCP server
• MCP agent permissions
• Monitoring
• Linux users
• Action audit log