Commands / kosa8 mcp-policy events
kosa8 mcp-policy events
Export MCP policy decisions for a SIEM (--format jsonl|cef)
Every decision is also anchored in the hash-chained kosa8 audit log as an
mcp.decision entry (the daemon writes it; the chain has one writer), and
that entry is the record of authority. This file is the flat copy existing
SIEM parsers read: each line stands alone, carries audit_seq for the entry
that anchors it (absent when the daemon was down), and identical decisions
share an event id so a SIEM can collapse them.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--denied | bool | show only denials | — |
--format | string | output format: jsonl, cef or table | jsonl |
-n, --limit | int | show only the most recent n (0 = all) | 0 |