Monitoring & Audit
Three dashboard pages tell you what's happening in your workspace: Audit Log (what happened), Metrics (how it's performing) and Sessions (who's connected right now).
Audit Log
Dashboard → Audit Log. A record of activity across your workspace — tool calls, configuration changes, member changes and sign-ins, each attributed to a user with a timestamp.
This is where you answer "who did what, and when". Every tool call is attributed to the member who triggered it, so an AI client acting on someone's behalf is traceable back to that person.
Useful for:
- Investigating an unexpected change to a tool or connection
- Confirming what an AI client actually called during a session
- Reviewing access changes after adding roles or members
- Producing a record for a compliance or security review
Metrics
Dashboard → Metrics. Tool call volume, latency and error rates over time.
| Metric | What it tells you |
|---|---|
| Calls | Volume over the selected period |
| Active Tools | How many tools are actually being used |
| Avg Latency | Mean response time, in ms |
| HTTP status | Response code distribution — where errors are |
Filter by time range (last 24 hours, 7 / 30 / 90 days, or a custom range), and break down by tool or by user.
What to watch
Latency climbing usually means your upstream API is slowing, not LockMCP — calls are proxied, so your API's response time is most of the number. For Tenant Delegated connections it can also mean your validate endpoint is slow, which is worth catching early since certification enforces a 5-second ceiling.
A rise in 4xx typically points at tool descriptions: the AI is constructing calls your API rejects. Fixing the description in Tool Studio usually resolves it.
A rise in 5xx is your API erroring on requests it accepted.
Tools with zero calls are either unpublished, not granted to any role, or described so poorly the AI never selects them.
Sessions
Dashboard → Sessions. Who is currently connected, and the ability to end a session.
Each row shows:
| Column | Meaning |
|---|---|
| Client | What connected — e.g. Claude Desktop, a browser, or a hub login |
| Connection | Which connection the session belongs to |
| IP address | Where it connected from |
| Created | When the session started |
| Last validated | Most recent confirmation the session is still good |
| Expires | When it lapses on its own |
Ending a session
Revoking a session cuts that client off. It's the fast path for:
- Someone leaving, where you need access gone now rather than at token expiry
- A device that may be compromised
- Forcing a re-authentication after changing someone's roles
Removing a member under Members & Access prevents future sign-ins but does not immediately invalidate an already-issued token for Identity Brokering or Token Exchange connections. For immediate cutoff, remove the member and revoke their sessions here.
Tenant Delegated behaves differently — your validate endpoint is consulted on tool calls, so revoking in your own app cuts access on the next one.
A monitoring routine
Nothing here needs daily attention once things are stable. A workable rhythm:
Weekly — glance at Metrics for latency or error-rate changes; check for tools with unexpected volume.
Monthly — review Sessions for stale connections; audit role access in the Tool Catalog; confirm members list matches who should still have access.
After any change — publishing tools, adding roles, or changing access all warrant a look at the Audit Log to confirm the change landed as intended.
Where to go next
- Security — encryption and key rotation
- Assigning Tool Access — auditing who can call what
- Troubleshooting — diagnosing what metrics surface