feat: Add structured audit logging for MCP feature server

[SIDDHESH1564]

What this PR does / why we need it:

This PR adds structured audit logging in JSONL format for the Python MCP feature server.

Previously, the MCP integration only logged startup events and errors. Operators did not have a unified audit trail for MCP tool calls, internal REST requests, authentication results, authorization decisions, or request correlation.

This change introduces an audit_logging configuration section under feature_server and adds structured audit events for:

• MCP tool invocations
• MCP JSON-RPC requests
• REST endpoint requests
• Authentication outcomes
• Authorization decisions
• Request correlation through X-Request-Id
• Client IP address and transport metadata

Each audit event follows a stable schema and includes:

• event_type
• UTC timestamp
• request_id
• principal (username, roles, and auth_type)
• source (ip and transport)
• action (MCP tool name and/or HTTP path)
• resource (type, name, and permitted actions)
• outcome
• duration_ms

Sensitive data is intentionally excluded from audit logs. Tokens, entity rows, feature values, and request payloads are not logged.

Audit logging layers

Layer	Scope	Event types
McpAuditMiddleware	/mcp JSON-RPC requests	mcp.tools.call, mcp.request
AuditLoggingMiddleware	REST endpoints such as /get-online-features and /push	http.request
AuditLogger helpers	Authentication and authorization hooks	authn.success, authn.failure, authz.decision

New files

• sdk/python/feast/audit/audit_logger.py

  • Adds the AuditEvent model.
  • Adds sink abstractions: StdoutAuditSink, FileAuditSink, and LoggerAuditSink.
  • Adds AuditLogger helper methods for MCP, HTTP, authentication, and authorization events.

• sdk/python/feast/audit/audit_middleware.py

  • Adds AuditLoggingMiddleware for REST endpoint auditing.
  • Adds McpAuditMiddleware for MCP JSON-RPC request auditing.

Modified files

• sdk/python/feast/infra/feature_servers/base_config.py

  • Adds AuditLoggingConfig to BaseFeatureServerConfig.

• sdk/python/feast/feature_server.py

  • Initializes the audit logger lifecycle.
  • Wires the audit middleware into get_app().

Example configuration

feature_server:
  type: mcp
  mcp_enabled: true
  audit_logging:
    enabled: true
    sink: stdout          # stdout | file | logger
    # file_path: /var/log/feast_audit.jsonl
    log_successful_reads: true

Example JSONL event

{
  "event_type": "mcp.tools.call",
  "timestamp": "2026-05-28T12:00:00.000Z",
  "request_id": "...",
  "principal": {
    "username": "jane@co.com",
    "roles": ["reader"],
    "auth_type": "oidc"
  },
  "source": {
    "ip": "10.0.0.1",
    "transport": "mcp-http"
  },
  "action": {
    "mcp_tool": "get_online_features",
    "path": "/mcp"
  },
  "outcome": "success",
  "duration_ms": 42.0
}

Which issue(s) this PR fixes:

Fixes #6452

Checks

• I've made sure the tests are passing.
• My commits are signed off (git commit -s)
• My PR title follows conventional commits format

Testing Strategy

• Unit tests
• Integration tests
• Manual tests
• Testing is not required for this change

Added 37 unit tests covering:

• AuditEvent serialization in JSONL format, including exclusion of None values

• AuditLogger helpers:

  • log_mcp_call
  • log_http_request
  • log_authn
  • log_authz

• Suppression of successful read events when log_successful_reads: false

• All supported sinks:

  • StdoutAuditSink
  • FileAuditSink
  • LoggerAuditSink

• create_audit_logger_from_config factory behavior and fallback handling

• AuditLoggingConfig validation and inheritance through McpFeatureServerConfig

• AuditLoggingMiddleware behavior:

  • HTTP request logging
  • Health and MCP route skipping
  • Error outcomes
  • X-Request-Id propagation
  • Resource mapping

• McpAuditMiddleware behavior:

  • MCP tool-call extraction from JSON-RPC request bodies
  • Generic MCP request logging
  • Non-JSON request-body handling

Misc

• audit_logging is defined on BaseFeatureServerConfig, making it available to both local and MCP feature server types.
• Principal metadata is extracted from the existing SecurityManager context and supports no_auth, oidc, and kubernetes authentication modes.
• Registry MCP parity and an OpenTelemetry sink are intentionally left as follow-up improvements, as noted in the linked issue.

[ntkathole]

@SIDDHESH1564

Registry MCP parity and an OpenTelemetry sink are intentionally left as follow-up improvements, as noted in the linked issue.

OTel is a follow-up is fine, but the core schema and sink abstraction feel like reinventing what opentelemetry-sdk already provides. Also, AuditEvent should carry a trace_id/span_id if OpenTelemetry is active.

Also, the fundamental problem with this is that it intercepts at the HTTP transport layer rather than at the MCP protocol layer. It should implement bidirectional correlation - linking a request to its response.

[SIDDHESH1564]

Thanks for the review, @ntkathole. Both points have been addressed.

• Added trace_id and span_id to AuditEvent, populated from the active OTel span when available.
• Added MCP request-response correlation using the JSON-RPC id.
• Added response-body inspection for JSON-RPC errors and a separate mcp_error outcome.

[SIDDHESH1564]

Will update the tests accordingly and push the revised commit once the changes are complete. Thanks!

[patelchaitany]

@SIDDHESH1564

Suggestion:

It might help to generate request_id once in the tools/call wrapper and propagate the same value to the internal REST call (e.g. via X-Request-Id and FastApiMCP(headers=[..., "x-request-id"])). Right now the MCP path always mints a new ID while REST reads the header, and most MCP clients don’t send X-Request-Id, so mcp.tools.call and http.request may not correlate in SIEM. Worth keeping jsonrpc_id separate from audit request_id. A test that both events share one request_id per tool call would be great.

[SIDDHESH1564]

@patelchaitany The mcp.tools.call and http.request events currently get independent request_id values, so they won't correlate in SIEM. Will add "x-request-id" to FastApiMCP's forwarded headers and propagate the audit request_id from the wrapper into the internal REST call. jsonrpc_id is already kept separate from request_id.

[SIDDHESH1564]

Now the flow is:

1. audited_call_tool generates request_id = "aaa-111-..." and stores it in mcp_audit_request_id ContextVar.
2. Calls original(ctx, params) → fastapi_mcp makes internal httpx request to /get-online-features.
3. AuditLoggingMiddleware runs, checks ContextVar first:
   propagated_id = mcp_audit_request_id.get() → "aaa-111-..."
   request_id = propagated_id or ...
4. Both events now have request_id = "aaa-111-..."
5. ContextVar is reset in finally so it doesn't leak to subsequent requests.

[patelchaitany]

@SIDDHESH1564 - have you tested this locally by running the Feast feature server and checking audit logs end-to-end?

My setup: fastapi-mcp==0.4.0, mcp==1.27.0, MCP enabled with mcp_transport: http and audit_logging enabled (file sink).

What I see: REST audit (http.request) works, but MCP tool-call audit does not. On startup I get: Cannot wrap MCP call_tool handler: _request_handlers not found The wrapper never attaches — the handler stays handler, not audited_call_tool — so no mcp.tools.call events are emitted. Unit tests pass because they mock _request_handlers["tools/call"], which doesn’t exist in 0.4.0.

Root cause: The PR wraps mcp.server._request_handlers["tools/call"], but in fastapi-mcp 0.4.0 + mcp 1.x the hook is mcp.server.request_handlers[CallToolRequest] with signature async def handler(req: CallToolRequest).

Suggested fix: Update _wrap_call_tool_handler() in mcp_server.py to wrap request_handlers[CallToolRequest], read principal from server.request_context, and forward x-request-id / x-feast-auth-type in FastApiMCP(headers=...). Add a unit test using a real FastApiMCP instance (not a mocked _request_handlers).

[SIDDHESH1564]

Thanks for the detailed report, @patelchaitany. you're right about the root cause. I've confirmed and fixed the issue.

The wrapper was targeting mcp.server._request_handlers["tools/call"], which was the internal API of an older mcp SDK.

[patelchaitany]

lgtm, @ntkathole

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 89.61938% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.42%. Comparing base (367001b) to head (f7b3e04).

Files with missing lines	Patch %	Lines
sdk/python/feast/audit/audit_middleware.py	81.48%	6 Missing and 4 partials ⚠️
sdk/python/feast/infra/mcp_servers/mcp_server.py	86.56%	6 Missing and 3 partials ⚠️
sdk/python/feast/audit/audit_logger.py	95.68%	3 Missing and 3 partials ⚠️
sdk/python/feast/feature_server.py	70.58%	4 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6456      +/-   ##
==========================================
+ Coverage   47.19%   47.42%   +0.23%     
==========================================
  Files         419      421       +2     
  Lines       51964    52249     +285     
  Branches     7548     7582      +34     
==========================================
+ Hits        24522    24777     +255     
- Misses      25689    25708      +19     
- Partials     1753     1764      +11     

Flag	Coverage Δ
go-feature-server	30.58% <ø> (ø)
python-unit	48.74% <89.61%> (+0.24%)	⬆️

Files with missing lines	Coverage Δ
.../python/feast/infra/feature_servers/base_config.py	100.00% <100.00%> (ø)
sdk/python/feast/feature_server.py	62.92% <70.58%> (+0.02%)	⬆️
sdk/python/feast/audit/audit_logger.py	95.68% <95.68%> (ø)
sdk/python/feast/infra/mcp_servers/mcp_server.py	85.92% <86.56%> (+0.63%)	⬆️
sdk/python/feast/audit/audit_middleware.py	81.48% <81.48%> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 367001b...f7b3e04. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[SIDDHESH1564]

@ntkathole Please review this PR at your convenience. Thanks!

[SIDDHESH1564]

@ntkathole please review this PR. Thanks!