drop mcp server audit log · parse tool calls + resource accesses + auth · runs locally
mcp server audit · json/csv · local only
heuristic screener · vendor schema varies · not definitive proof