Check what your AI agent did

The MCP Audit Log lists every request that AI agents made with your team’s tokens and connected apps. Use it to check what an assistant did. You can also use it to find errors and activity that you did not expect. Only Admins can open it.

Open the log

To see the log:

1. In the sidebar, go to Tools → MCP Audit Log.

   

2. The newest requests are at the top. The page refreshes itself every 30 seconds.

   

Each row is one request. These are the columns:

Column	What it shows
When	Date and time of the request
Method	What the agent asked for: tools/call runs a tool, tools/list asks which tools exist, initialize starts a connection, ping checks the connection
Tool	The tool that ran, such as list_transactions or update_form_prices. Empty for requests that are not tool calls
Auth	pat for a Personal Access Token, oauth for an app connected by sign-in, such as Claude or ChatGPT
Status	200 when BCL accepted the request, 400 when it refused it, for example a tool that does not exist, a missing permission or a rate limit
Error?	A warning sign when the request failed. This includes a tool that ran but rejected its input
Duration	How long BCL took, in milliseconds

Two more columns are hidden at first: IP and OAuth Client. To show them, click Columns, tick them and click Apply columns.

Use Search to find a tool name or an IP address.

Filter the log

Filters show only the requests that you want to check. To filter:

1. Click Filter.

2. Choose any of these:

   Filter	Use it to
   Method	Show only tool calls (tools/call), or only connections and tool lists
   Token type	Show only PAT (token) or only OAuth (connected app) requests
   Errors only	Show only failed requests, or only successful ones

   

See one request in full

Click View on a row to open the MCP Audit Entry. It shows the request (when, method, tool, duration), the response (status, error), and the connection: Auth, OAuth Client, IP Address and User Agent. The user agent usually names the app, and OAuth Client shows the connected app’s client ID, a long code.

The log does not keep what the agent sent or what BCL answered. So the log never holds your customers’ details or new prices. To see the result of a change, open the form, coupon or content in the dashboard.

Spot unexpected activity

Look through the log often, and after you connect a new app. Look closely at these signs:

Sign	What it can mean
Write tools you did not ask for, such as update_form_webhook, update_form_prices or create_payment_link	The agent misread a request, or someone else uses the access
Requests at night or on days when nobody worked	A script, or a token used by someone else
An IP address or User Agent you do not recognise	The token was copied to another computer or app
Many rows with the warning sign	A wrong setup, a token without the right permission, or an agent that hit the rate limit

update_form_webhook and update_form_redirect_urls need special care. They decide where BCL sends your payment data and your customers after a payment. If you see one that you did not ask for, check the form’s webhook and redirect settings at once.

Stop an agent

When you stop an agent, its access stops at once. Use the step that matches the Auth column:

• oauth: go to Platform Setup → Integrations and click Manage on the AI agents card. Click the Revoke access icon on the app’s row, then click Revoke Access. See Disconnect an AI app.
• pat: on the same page, click Manage on the API tokens card. Click the Delete token icon on the token’s row. See Create an API token.

Each Admin sees and removes only their own tokens and connected apps. If the request came from another Admin’s access, ask them to remove it. Then check what the agent changed. Correct the changes in the dashboard.

Tips

Two habits make the log more useful:

• Name tokens after the app and computer. The log shows pat but not the token name. If you use one token for each app, it is easier to find the token to delete.
• Check after big jobs. After an assistant changes many forms or prices, filter by Method tools/call. Then read down the Tool column.

Common issues

Can I see what the AI changed, for example the new price it set?

No. The log shows which tool ran, when it ran and if it worked. It does not show the values that the agent sent. Check the form, coupon or content itself in the dashboard to see the result.

Which staff member's AI made this request?

The log does not show the user. Use the Auth column (pat for a token, oauth for a connected app), and turn on the IP and OAuth Client columns to tell connections apart.

See it in the steps

Someone is using a token I do not recognise. How do I stop it?

Go to Platform Setup → Integrations. Delete the token on the API tokens card, or revoke a connected app on the AI agents card. Access stops at once.

Related articles

• Connect Claude or ChatGPT to BCL
• MCP tools reference
• Set up other AI apps (Cursor, Claude Code, VS Code and more)
• Create an API token