Visibility into MCP Usage - Netskope Technical Documentation

Administrators can use the Skope IT application to monitor communications between MCP clients, such as VS Code, and MCP servers in real-time to ensure compliance and detect potential threats. This visibility allows you to track the entire lifecycle of an interaction—from the initial handshake where protocol versions and capabilities are established, to the specific invocation of tools like the Notion MCP server. By reviewing detailed event logs and initialization data, you can verify successful tool executions and resource requests while ensuring that sensitive data remains protected. This streamlined oversight ensures that your use of MCP tools is both transparent and secure.

Contact your Netskope account team to enable Agentic Broker license in your account. To create and enforce DLP policies, the DLP add-on license is required.

Key Monitoring Features

Live Event Monitoring: View real-time MCP-related events and alerts between clients and servers as they occur within your network.
Detailed Event Data: Each event display includes all applicable attributes, providing full context for every MCP communication.
Initialization Details: Analyze “initialization requests” to identify the Client Name, Protocol Version, and Client Capabilities (e.g., Elicitation, Sampling etc.) . Analyze “initialization responses” to identify the MCP Server Name, Protocol Version and Server Capabilities (e.g., Notion MCP Server).
Tools, Prompt Template and Resources requests: Review the list of tools, prompt templates and resources requests.
Tool Usage: Monitor specific tool invocations (e.g., create pages) and view the “call tool result” to verify the successful execution of those requests. Due to the possibility of sensitive data being present in the responses of tools requests the content of the response is not shown in SkopeIT.

Supported MCP Activities

No	Activity Name	Direction
1	InitializeRequest	client to server
2	InitializeResult	server to client
3	ListPromptsResult	server to client
4	ListResourcesResult	server to client
5	ListResourceTemplatesResult	server to client
6	ListToolsResult	server to client
7	CallToolRequest	client to server
8	CallToolResult	server to client
9	GetPromptRequest	client to server
10	GetPromptResult	server to client
11	ReadResourceRequest	client to server
12	ReadResourceResult	server to client
13	CreateMessageRequest	server to client
14	CreateMessageResult	client to server
15	ElicitResult	client to server

Viewing MCP Activities in SkopeIT

To understand how these events appear in practice, consider a scenario where a user connects a VS Code client to a Notion MCP Server.

List of Activities Viewable in SkopeIT

Activity Name	Direction
ListPromptsRequest	client -> server
ListResourcesRequest	client -> server
ListResourceTemplatesRequest	client -> server
ListToolsRequest	client -> server
SubscribeRequest	client -> server
UnsubscribeRequest	client -> server
ListRootsRequest	server -> client
ListRootsResult	client -> server
Notification	client <-> server
ElicitRequest	server -> client

The application name shown in the SkopeIT Application field for a Remote MCP Server may not match the MCP Server Name field. This is because the Application field shows the publicly known name of the MCP server, while the MCP Server Name field shows the name the MCP server uses to identify itself in messages.

VS Code: Start Notion MCP Server

Initialization – When you start the Notion MCP Server in VS Code, SkopeIT captures the InitializeRequest. You can view the client name and its specific capabilities in the Application Events page.
- Setup
- Event Log
- Handshake Detail
Following this, the InitializeResult identifies the server name and the protocol version being used.
- Server Detail
Discovery of Tools and Resources – SkopeIT logs the ListToolsResult activity, allowing administrators to see the full list of capabilities and tools offered by the connected MCP server.
- Event log
- Expanded Tool List
Execution and Results – When a user runs a specific tool (e.g., notion-create-pages with the title “Demo”), the action is logged as a CallToolResult. Clicking the event in the Application Events Details pane provides the outcome of the request, confirming whether the page creation was successful.
- User Command
- Execution Log
- Success Verification
Resource Requests – The client may also initiate ReadResourceRequest actions. The results of these requests are similarly tracked within the SkopeIT application events, providing a complete audit trail of data access.
- Audit Trail