Visibility into MCP Usage

Administrators can use the Skope IT application to monitor communications between MCP clients, such as VS Code, and MCP servers in real-time to ensure compliance and detect potential threats. This visibility allows you to track the entire lifecycle of an interaction—from the initial handshake where protocol versions and capabilities are established, to the specific invocation of tools like the Notion MCP server. By reviewing detailed event logs and initialization data, you can verify successful tool executions and resource requests while ensuring that sensitive data remains protected. This streamlined oversight ensures that your use of MCP tools is both transparent and secure.

Key Monitoring Features

• Live Event Monitoring: View real-time MCP-related events and alerts  between clients and servers as they occur within your network.
• Detailed Event Data: Each event display includes all applicable attributes, providing full context for every MCP communication.
• Initialization Details: Analyze “initialization requests” to identify the Client Name, Protocol Version, and Client Capabilities (e.g., Elicitation, Sampling etc.) . Analyze “initialization responses” to identify the MCP Server Name, Protocol Version and Server Capabilities (e.g., Notion MCP Server). 
• Tools, Prompt Template and Resources requests: Review the list of tools, prompt templates and resources requests. 
• Tool Usage: Monitor specific tool invocations (e.g., create pages) and view the “call tool result” to verify the successful execution of those requests. Due to the possibility of sensitive data being present in the responses of tools requests the content of the response is not shown in SkopeIT. 

Supported MCP Activities

Viewing MCP Activities in SkopeIT

To understand how these events appear in practice, consider a scenario where a user connects a VS Code client to a Notion MCP Server.

List of Activities Viewable in SkopeIT

VS Code: Start Notion MCP Server

1. Initialization – When you start the Notion MCP Server in VS Code, SkopeIT captures the InitializeRequest. You can view the client name and its specific capabilities in the Application Events page.

   • Setup

     

   • Event Log

     

   • Handshake Detail

     

   Following this, the InitializeResult identifies the server name and the protocol version being used.

   • Server Detail

     

2. Discovery of Tools and Resources – SkopeIT logs the ListToolsResult activity, allowing administrators to see the full list of capabilities and tools offered by the connected MCP server.

   • Event log

     

   • Expanded Tool List

     

3. Execution and Results – When a user runs a specific tool (e.g., notion-create-pages with the title “Demo”), the action is logged as a CallToolResult. Clicking the event in the Application Events Details pane provides the outcome of the request, confirming whether the page creation was successful.

   • User Command

     

   • Execution Log

     

   • Success Verification

     

4. Resource Requests – The client may also initiate ReadResourceRequest actions. The results of these requests are similarly tracked within the SkopeIT application events, providing a complete audit trail of data access.

   • Audit Trail