Skip to main content
The audit log is a customer-visible append-only record of every privileged action on your workspace. MCP writes record the tool name and authenticated key.

What gets logged

Writes only. Reads are intentionally not audited — the read trust boundary is the MCP-key auth check, not per-row logging. Logged actions include: Things that are deliberately not logged:
  • MCP read tools (blocks.list, canvases.get, auditLog.recent, workspace.get, etc.).
  • Web UI navigation and public canvas views.

Row shape

Each row carries:
  • workspaceId — the workspace the action targeted.
  • actor — who, in a structured string:
    • "user:<authUserId>" — a human acting through the web UI.
    • "mcp:<apiKeyId>" — an MCP call authenticated by a cb_live_* key.
  • action — what, as a dotted verb:
  • targetId — the resource id this action acted on (block id, canvas id, etc.). Nullable for actions without a single target.
  • createdAt — ISO timestamp.
  • metadata — optional structured detail (e.g. the build result).

How to query

Any coding agent connected to the workspace can call:
limit defaults to 50 and caps at 200. Returns rows newest-first. See the MCP tool reference for the full schema.

Retention

When you’re debugging “why did this block change,” start with auditLog.recent filtered to that block’s id (client-side filter on the targetId field). The actor will tell you whether it was you in the web UI, an MCP key, — and the action tells you which tool ran.

What’s next

MCP tool reference

The full schema for auditLog.recent and every other MCP tool.