Event Log

A Model Context Protocol (MCP) server resource permitting MCP clients to log events to the Event Log. Alert and Emergency events also get propagated to operators immediately.

Table of Contents
  1. MCP Server Interface
  2. MCP Server Tools
    1. Log Alert Event
    2. Log Critical Error Event
    3. Log Debug Event
    4. Log Emergency Event
    5. Log Error Event
    6. Log Informational Event
    7. Log Notice Event
    8. Log Warning Event
    9. Search for Events
  3. MCP Server Prompts
    1. Find Sensitive Information
  4. JSON-RPC Interface
    1. initialize(ProtocolVersion, Capabilities, ClientInfo)
    2. notifications/initialized()
    3. prompts/get(Name, Arguments, _Meta)
    4. prompts/list(Cursor)
    5. resources/list(Cursor)
    6. resources/read(Uri, _Meta)
    7. resources/subscribe(Uri)
    8. resources/unsubscribe(Uri)
    9. tools/call(Name, Arguments, Task, _Meta)
    10. tools/list(Cursor)
  5. Types
    1. SearchResult
    2. PromptMessage
    3. Event
    4. Tag

MCP Server Interface

This MCP Server is accessible on this endpoint: https://lab.tagroot.io/MCP/EventLog

Scopes supported:

The following subsections list MCP Server interfaces that are available on this resource. The MCP protocol is built on top of the JSON-RPC protocol. You find JSON-RPC interface below.

MCP Server Tools

Following subsections list MCP Server Tools that can be used to interact with the MCP Server.

Log Alert Event

Logs an alert event to the event log. An alert error is so grave, that action must be taken immediately. Logged alert events also get propagated to operators immediately.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogAlert(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Alert
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Critical Error Event

Logs a critical error event to the event log. A critical error is an error so great that it could escalate into something graver if not addressed. Typically, a Critical error is typically an unexpected error.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogCritical(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Critical
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Debug Event

Logs an event for debug purposes to the event log. The purpose of debug events is to highlight technical information to developers, for troubleshooting.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogDebug(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Debug
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Emergency Event

Logs an emergency event to the event log. An emergency error signals the system is unusable, or will become unusable if action is not taken immediately. Logged emergency events also get propagated to operators immediately.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogEmergency(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Emergency
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Error Event

Logs an error event to the event log. Error events inform operators of normal error conditions. A normal error condition is typically an expected error.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogError(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Error
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Informational Event

Logs an informational event to the event log. The purpose of informational events is to provide a record of normal operational tasks being performed or events occurring.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogInformational(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Information
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Notice Event

Logs an notice event to the event log. A Notice represents a significant condition or change that administrators should be aware of.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogNotice(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Notice
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Log Warning Event

Logs a warning event to the event log. Warning events warn operators of conditions that may lead to errors if they are not properly managed.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

LogWarning(Message, Object, Actor, Level, EventId, Facility, Module)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Log.Warning
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Message String Required - The body text of the logged event.
Object String Optional "" The object associated with the event, if any.
Actor String Optional "" The subject, or actor, performing the action resulting in the event being logged.
Level EventLevel Optional "Minor"

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
EventId String Optional "McpEvent" Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String Optional "" The subsystem or external component that is the source of the event.
Module String Optional "" The module or component within the source that is the source of the event.

Search for Events

Performs a search for events in the event log.

Properties
Can Modify: Yes
Can Destroy: No
Is Idempotent: No
Open World Access: No

Search(Offset, MaxCount, From, To, Message, Object, Actor, EventId, Module, Facility, Debug, Informational, Notice, Warning, Error, Critical, Alert, Emergency, Minor, Medium, Major)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Tools.Search
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
Offset 32-bit signed integer Optional 0 Offset into search result set where returned events begin. [0,2147483647]
MaxCount 32-bit signed integer Optional 100 Maximum number of results to return. [1,1000]
From Nullable Date & Time Optional null Start date/time for search, in UTC. If provided, only events newer than or equal to this point in time will be returned. (∞,∞)
To Nullable Date & Time Optional null End date/time for search, in UTC. If provided, only events older than or equal to this point in time will be returned. (∞,∞)
Message String Optional null Message to search for. If provided, only events containing this message text will be returned.
Object String Optional null Object to search for. If provided, only events with this object will be returned. This property represents the object associated with the events.
Actor String Optional null Actor to search for. If provided, only events with this actor will be returned. This property represents the subject, or actor, performing the action resulting in the events being logged.
EventId String Optional null Event ID to search for. If provided, only events with this event ID will be returned. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Module String Optional null Module ID to search for. If provided, only events with this module will be returned. This property represents the module or component within the source that is the source of the event.
Facility String Optional null Facility ID to search for. If provided, only events with this facility will be returned. this property represents the subsystem or external component that is the source of the event.
Debug Nullable Boolean Optional null If provided, determines if debug events are to be included in the result. The purpose of debug events is to highlight technical information to developers, for troubleshooting.
Informational Nullable Boolean Optional null If provided, determines if informational events are to be included in the result. The purpose of informational events is to provide a record of normal operational tasks being performed or events occurring.
Notice Nullable Boolean Optional null If provided, determines if notice events are to be included in the result. A Notice represents a significant condition or change that administrators should be aware of.
Warning Nullable Boolean Optional null If provided, determines if warning events are to be included in the result. Warning events warn operators of conditions that may lead to errors if they are not properly managed.
Error Nullable Boolean Optional null If provided, determines if error events are to be included in the result. Error events inform operators of normal error conditions. A normal error condition is typically an expected error.
Critical Nullable Boolean Optional null If provided, determines if critical error events are to be included in the result. A critical error is an error so great that it could escalate into something graver if not addressed. Typically, a Critical error is typically an unexpected error.
Alert Nullable Boolean Optional null If provided, determines if alerts events are to be included in the result. An alert error is so grave, that action must be taken immediately.
Emergency Nullable Boolean Optional null If provided, determines if emergencies events are to be included in the result. An emergency error signals the system is unusable, or will become unusable if action is not taken immediately.
Minor Nullable Boolean Optional null If provided, determines if minor events are to be included in the result. Minor events occur frequently.
Medium Nullable Boolean Optional null If provided, determines if medium events are to be included in the result. Medium events update something, or reports something could cause a major event.
Major Nullable Boolean Optional null If provided, determines if major events are to be included in the result. Major events adds or destroys something, or reports something important is out of order.
Return Value
Type Description
SearchResult Result set of the search for events, as well as information about if more events are available, and the offset to the next set of events.

MCP Server Prompts

Following subsections list MCP Server Prompts that can be used to interact with the MCP Server.

Find Sensitive Information

Search for events in the event log containing sensitive information that should never have been logged.

FindSensitiveInformation(NrDays, FindSuspectActivity, FindIntrusions, FindResourceDepletion, FindCredentials, FindKeys, FindSensitivePersonalInformation, ReportEventsFound, EditEvents, DeleteEvents)

Authentication
Required: Yes
Privileges Required: OAUTH.Scope.MCP.EventLog.Prompts.FindSensitiveInfo
Authentication Mechanisms: Bearer JWT (128+ bit Encryption), Basic (128+ bit Encryption), Digest-MD5 (128+ bit Encryption), Digest-SHA-256 (128+ bit Encryption), Digest-SHA-3-256 (128+ bit Encryption), Session
Arguments
Name Type Use Default Value Description
NrDays 32-bit signed integer Optional 7 Number of days back in time the search for events should be performed. (∞,∞)
FindSuspectActivity Boolean Optional true If true, the search will look for activity that is suspicious.
FindIntrusions Boolean Optional true If true, the search will look for evidence of intrusions.
FindResourceDepletion Boolean Optional true If true, the search will look for evidence of resources being depleted, or being close to be depleted.
FindCredentials Boolean Optional true If true, the search will look for credentials in the events.
FindKeys Boolean Optional true If true, the search will look for keys in the events.
FindSensitivePersonalInformation Boolean Optional true If true, the search will look for sensitive personal information in the events.
ReportEventsFound Boolean Optional true If true, the search will generate a report of all events containing sensitive information found during the search.
EditEvents Boolean Optional false If true, the events found will be edited accordingly, to remove the sensitive information.
DeleteEvents Boolean Optional false If true, the events found that cannot be edited, will be deleted accordingly, to remove the sensitive information and associated information in the associated event.
Return Value
Type Description
Array of PromptMessage

JSON-RPC Interface

This JSON-RPC Web Service is accessible on this endpoint: https://lab.tagroot.io/MCP/EventLog

The following subsections list JSON-RPC methods that are available on this resource.

initialize(ProtocolVersion, Capabilities, ClientInfo)

MCP initialize method. Called by client to initialize connection and exchange information about capabilities.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
ProtocolVersion String Required - Protocol Version
Capabilities Dictionary Required - Client capabilities
ClientInfo Dictionary Required - Client information
Return Value
Type Description
Dictionary Server capabilities and information.

notifications/initialized()

Notification that the client has completed its initialization.

Authentication
Required: No

prompts/get(Name, Arguments, _Meta)

Gets an MCP server prompt.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Name String Required - Name of the prompt to call.
Arguments Dictionary Required - Arguments for the prompt.
_Meta Object Optional null Associated meta-data, if available.
Return Value
Type Description
Dictionary Dictionary containing the prompt.

prompts/list(Cursor)

Lists available MCP server prompts.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Cursor String Optional null Cursor for pagination.
Return Value
Type Description
Dictionary Dictionary containing the list of prompts.

resources/list(Cursor)

Lists available MCP server resources.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Cursor String Optional null Cursor for pagination.
Return Value
Type Description
Dictionary Dictionary containing the list of resources.

resources/read(Uri, _Meta)

Reads an MCP server resource.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Uri URI Required - URI of the resource to read.
_Meta Object Optional null Associated meta-data, if available.
Return Value
Type Description
Dictionary Dictionary containing the contents of the resource.

resources/subscribe(Uri)

Subscribes to an MCP server resource.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Uri URI Required - URI of the resource to subscribe to.

resources/unsubscribe(Uri)

Unsubscribes from an MCP server resource.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Uri URI Required - URI of the resource to unsubscribe from.

tools/call(Name, Arguments, Task, _Meta)

Calls an MCP server tool.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Name String Required - Name of the tool to call.
Arguments Dictionary Required - Arguments for the tool.
Task Object Optional null

If specified, the caller is requesting task-augmented execution for this request. The request will return a CreateTaskResult immediately, and the actual result can be retrieved later via tasks/result.

Task augmentation is subject to capability negotiation - receivers MUST declare support for task augmentation of specific request types in their capabilities.
_Meta Object Optional null Associated meta-data, if available.
Return Value
Type Description
Dictionary Dictionary containing the result of the tool call.

tools/list(Cursor)

Lists available MCP server tools.

Authentication
Required: No
Arguments
Name Type Use Default Value Description
Cursor String Optional null Cursor for pagination.
Return Value
Type Description
Dictionary Dictionary containing the list of tools.

Types

This Web Service encodes named types as JSON dictionary objects. The following subsections list the named typed and their corresponding properties.

SearchResult

Properties
Name Type Description
More Boolean If more events are available.
NextOffset Nullable 32-bit signed integer Offset into search result set where the next page of events begin, if the More parameter is true. [0,2147483647]
Events Array of Event Array of events returned by the search.

PromptMessage

Properties
Name Type Description
Role McpRole

Role of recipient of message. Possible values:

  • "Assistant" - Message is for the assistant.
  • "User" - Message is from the user.
Content Object Content of message.
IsEncoded Boolean If the content has been encoded.
Encoded Dictionary Encoded content.

Event

Properties
Name Type Description
ObjectId String ID of event object in persistent storage.
Timestamp Date & Time Timestamp of event, in UTC. (∞,∞)
Type EventType

Type of event. Possible values:

  • "Debug" - Debug event. Debug events highlight technical information to developers, for troubleshooting.
  • "Informational" - Informational event. Informational events provide a record of normal operational tasks being performed or events occurring.
  • "Notice" - Notice event. Notice events highlight important information that may require attention.
  • "Warning" - Warning event. Warning events highlight potential issues that may require attention.
  • "Error" - Error event. Error events indicate a problem that has occurred.
  • "Critical" - Critical event. Critical events indicate errors so great that it could escalate into something graver if not addressed.
  • "Alert" - Alert event. Alert events indicate a condition that requires immediate action.
  • "Emergency" - Emergency event. Emergency events signals the system is unusable, or will become unusable if action is not taken immediately.
Level EventLevel

The level of the event being logged. Minor events occur frequently, Medium events update something, or reports something could cause a major event, Major events adds or destroys something, or reports something important is out of order. Possible values:

  • "Minor" - Minor Event
  • "Medium" - Medium Event
  • "Major" - Major Event
Message String The body text of the logged event.
Object String The object associated with the event, if any.
Actor String The subject, or actor, performing the action resulting in the event being logged.
EventId String Optional Event ID for the event. Event IDs are used to identify a specific type of event, and is used collect related information in reports.
Facility String The subsystem or external component that is the source of the event.
Module String The module or component within the source that is the source of the event.
StackTrace String Stack trace of the event, if any.
Tags Array of Tag Variable set of tags providing event-specific information.

Tag

Properties
Name Type Description
Name String Name of tag
Value Object Value of tag