MCP Incidences

MCP traffic lands in the same Incidences screen as LLM traffic. This page covers what is specific to MCP: the filters, the columns and the detail fields that describe tool calls.


Find MCP Traffic

Click the MCP preset in Incidences to show all MCP traffic. To narrow it further, open Advanced → MCP and consumers:

FilterValues
Operationtools/list, tools/call, resources/list, resources/read, prompts/list, prompts/get, or any
ToolThe real tool that ran, never the route alias
Tool originOwn (your endpoint) or Upstream (imported from an MCP server)
ConsumerThe consumer credential that called

initialize calls are never recorded.

Filter by the real tool name

A route can publish a tool under an alias, and the alias can point to a different tool tomorrow. Incidences records and filters by the real tool that ran, so the history stays accurate.


MCP Rows

ByteHide AI Runtime incidences of MCP tool calls with Blocked and Allowed verdicts for prompt injection, PII, code injection and an unknown toolClick to expand

For MCP rows, the Model / Tool column shows the real tool and, below it, the operation. The other columns read as for any incidence. Typical MCP detections:

DetectionExample
Prompt injectionInstructions smuggled into a tool argument
PII / secretsA credential or personal data sent as an argument
Code injectionA SQL payload in an argument
Policy controlA call to a tool the route does not publish (mcp_tool_unknown)

MCP Detail Fields

The incidence detail of an MCP call adds:

FieldDescription
Tool call argumentsThe arguments the client sent, when the route stores request content
OperationThe JSON-RPC method
Alias called / ToolThe name the client used on the route and the real tool behind it
Tool origin / UpstreamOwn or imported, and the server's URL
Result inspectionWhether the tool result was inspected before it went back to the client

The Full trace shows whether the call reached the upstream (Upstream call) or was stopped before it (Not forwarded).

ByteHide AI Runtime trace detail of a blocked MCP tool callClick to expand


Next Steps

Triage & Feedback

Act on an MCP incidence

Tools

Review tools and schema drift

Previous
Tools