pingidentity/aic-mcp-server · Archived
Audit and report on MCP server activity in AIC logs — authentication events, user-attributed actions, and API traffic.
npx skills add pingidentity/aic-mcp-server --skill monitor-usage
This repository is archived — consider an actively maintained alternative.
Required conventions for writing and modifying tests — framework, file template, section orderi…
8 installsCode review checklists and common pitfalls for this codebase — security, correctness, conventio…
8 installsRequired conventions for MCP tool implementation — structure, response formatting, annotations,…
8 installsAlert by webhook/email on web changes — use for "monitor/watch/track/alert me when": recurring …
31.8K installsRelated neighbors and high-traction skills in the same topics — useful to compare before installing.
Continuously track the web for changes on a recurring cadence.
10.8K installsInstalls, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor…
3.2K installsSetup Sentry AI Agent Monitoring in any project. Use when asked to monitor LLM calls, track AI …
2.8K installsTrack reviews, ratings, sentiment, and brand mentions across Google Maps, Booking.com, TripAdvi…
2.5K installsBuild macroeconomic and rates dashboards combining macro indicators, yield curves, inflation br…
2.1K installsAlert by webhook/email on web changes — use for "monitor/watch/track/alert me when": recurring …
1.6K installsOther skills from pingidentity/aic-mcp-server.
npx skills add pingidentity/aic-mcp-server
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
main
Files included with this skill beyond the listing page.
SKILL.md
4,209 B
SUMMARY.md
365 B
Use the getLogSources and queryLogs tools to retrieve and interpret AIC audit logs. Always check the current time before querying so time ranges are accurate.
These values identify MCP server activity in the logs:
| Marker | Value | Where it appears |
|---|---|---|
| Initial auth client | AICMCPClient |
am-authentication — PKCE / Device Code login |
| Token exchange client | AICMCPExchangeClient |
am-authentication — one AM-TOKEN-EXCHANGE event per tool call |
| API User-Agent | aic-mcp-server/<version> |
idm-access, am-access — all outbound API requests |
| Source | What to look for |
|---|---|
am-authentication |
AM-TOKEN-EXCHANGE events for AICMCPExchangeClient — proxy for tool invocation count and timing; AM-TREE-LOGIN-COMPLETED for user login events |
am-config |
AM-CONFIG-CHANGE events — journey, node, script, and OIDC app changes; userId field shows the authenticated user |
idm-access |
Per-request HTTP log; filter by user-agent co "aic-mcp-server" to isolate MCP traffic from browser and reconciliation jobs |
idm-activity |
Full before/after state for managed object operations (CREATE, PATCH, DELETE on users, groups, roles, etc.); runAs field shows the authenticated user |
Token exchanges = tool invocations. Each AM-TOKEN-EXCHANGE for AICMCPExchangeClient corresponds to one tool call. Bursts of exchanges within a few seconds indicate a multi-step tool (e.g. createJourney creating nodes in parallel).
Two runAs values in AM config logs are expected. dsameuser indicates a platform write triggered by the user's token; id=<uuid> is the user's own identity. Both appear within the same transaction and are both attributable to the authenticated user.
User attribution chain. Each AM-TOKEN-EXCHANGE event carries a subjectAuditTrackingId that references the original AM-TREE-LOGIN-COMPLETED event for the session, linking every tool call back to the authenticated identity.
Filter authentication events by MCP client:
/payload/principal co "AICMCPExchangeClient"Filter IDM access log for MCP API calls:
/payload/http/request/headers/user-agent co "aic-mcp-server"Filter AM config changes to a specific journey:
/payload/objectId co "JourneyName"Filter IDM activity for a specific object type:
/payload/objectId co "managed/alpha_user"When presenting findings, structure the output as:
fr:idc:monitoring:* scoped exchanges)Use tables for timelines. Note the window queried and whether any sources had truncated results (paged results cookie present).