Skip to content

MCP monitoring & access control

The web console includes a dedicated MCP view for tenant administrators. It answers the questions you have once AI clients are connected to your MCP server: who and what is using it right now, what are they reaching, and how do I cut something off? — all without leaving the console.

It has four tabs: Flow, Connections, Tokens, and Settings.

Access flow

The Flow tab is a live picture of MCP activity for your tenant. It traces each request across four columns — Users → Platforms → Tools → Sources — so you can see, at a glance, which people, through which AI applications, are calling which capabilities against which of your sources.

The MCP access-flow view: a live graph tracing requests from users, through AI platforms, to tools, to sources, with a time-window selector and filters.

  • Live. New activity appears as it happens; a "live" indicator confirms the stream is connected.
  • Windowed. Switch the time window (last 15 minutes through 7 days) to move between "what's happening now" and "what happened today."
  • Filterable. Narrow the view by user, AI platform, tool, and outcome (allowed or denied) to focus an investigation.

Because every request is security-trimmed, the flow shows real, authorized access — including denials, which are valuable on their own: a spike of denied calls is an early signal worth looking at.

Connections

The Connections tab rolls up the clients currently and recently talking to your MCP endpoint — the AI application, the user behind it, and how active each one is. It's the fastest way to confirm an integration is working, or to spot a client you don't recognise.

Tokens

The Tokens tab lists the credentials and sessions that currently have MCP access for your tenant, alongside their recent use. From here an administrator can revoke access immediately — a personal access token or an active sign-in session — and the change takes effect on the next call. This is your kill switch when a credential is retired or a device is lost.

Tokens are also managed per user from the token menu; this tab gives administrators a tenant-wide view and revocation in one place.

Settings

The Settings tab controls which sources are exposed over MCP. Cataloguing a source in K-Lake doesn't automatically publish it to AI clients — you choose, per source, whether it's reachable through the MCP endpoint. That lets you index broadly for the web console while exposing only a curated subset to assistants.

How this relates to the audit log

The Flow and Connections views are the real-time, visual face of the same activity that K-Lake records to its audit trail. Everything an AI client does over MCP — every tool call and every denied attempt — is captured with who, what, when, and where. The console is for live monitoring and quick action; for long-term review, export, or feeding a security service, use the audit log described under MCP server → Audit.

See also