Skip to content
AccessVault Docs

The Audit Log

Every database operation — whether Claude issued it over MCP or you clicked a button in the app — is recorded in a single append-only audit log. This is the core of AccessVault: the AI has no path to your database that skips it.

What’s recorded

Each entry captures:

  • Timestamp, a unique entry ID, and a request ID for correlating with client-side logs
  • The connection and database kind
  • The tool that ran (catalog tool ID + name for MCP calls; builtin:<command> for in-app actions like builtin:create_user or builtin:ssh_reconnect)
  • The parameters as passed (for user-management actions, passwords are excluded)
  • The outcome — on success, the row count, whether the result was truncated, and duration; on error, the error message and duration
  • Any redacted columns the data exposure policy dropped or masked from the result

The guarantee, for MCP calls: the entry is written before results are returned — including for failed queries — and if the audit write itself fails, the request fails. See Security Model.

Two deliberate exceptions are not logged: Test Connection (a dry run that touches no data) and reading the audit log itself.

The Audit Log tab

The Audit Log tab shows entries across all connections, newest first. You can filter by:

  • Tool name — free-text, case-insensitive
  • Outcome — Success / Error / Truncated chips
  • Connection — dropdown, defaults to “All connections”

There’s no date-range filter yet. Expand an entry to see the full timestamp, duration, row count or error, request ID, redacted columns, and the parameters as JSON.

The viewer loads up to a capped number of recent entries (default 5,000; adjustable in Settings). Older entries stay in the file — see below.

Where the file lives

The log is a JSON Lines file — one JSON object per line — at:

~/Library/Application Support/com.accessvault.dev/audit.jsonl

Because it’s plain JSONL, standard tooling works on it directly (jq, grep, log shippers). That’s also the honest way to “export” it — the app itself has no audit-log export button; only the audit-readiness scan has PDF/CSV export.

Honest limits

  • The file is append-only by design of the app — nothing in AccessVault can edit or delete entries — but it is not cryptographically tamper-evident, and anything with filesystem access can modify it. If you need stronger guarantees, ship it to an external log store.
  • Writes are flushed per entry but not fsynced; a hard crash can lose the final entries.
  • There is no retention policy — the file grows until you rotate or archive it yourself.