Commands / kosa8 mcp-policy events
kosa8 mcp-policy events
Export MCP policy decisions for a SIEM (--format jsonl|cef)
Decisions live in their own append-only log, separate from the hash-chained
kosa8 audit log: both the CLI and the daemon evaluate policy, and two
processes appending to one chain would break it. Each line stands alone,
and identical decisions share an event id so a SIEM can collapse them.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--denied | bool | show only denials | — |
--format | string | output format: jsonl, cef or table | jsonl |
-n, --limit | int | show only the most recent n (0 = all) | 0 |