> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Observability Overview

> How Ultra monitors and records MCP traffic

Ultra provides complete observability over MCP traffic through a pipeline of four interceptors. Every tool call, resource read, and prompt request is automatically traced, logged, audited, and measured.

## The Pipeline

Every MCP request passes through Ultra's observability layers before reaching the upstream server. Responses pass back through the same layers:

```mermaid theme={null}
graph LR
    Client["<b>MCP Client</b>"]
    Pipeline["<b>Pipeline</b><br/>Trace · Logging · Audit · Metrics"]
    Server["<b>Upstream Server</b>"]

    Client -->|"Request"| Pipeline
    Pipeline -->|"Request"| Server
    Server -->|"Response"| Pipeline
    Pipeline -->|"Response"| Client
```

| Layer       | What It Records                                                |
| ----------- | -------------------------------------------------------------- |
| **Trace**   | Distributed traces with request/response payloads and duration |
| **Logging** | Structured log entries for every request/response              |
| **Audit**   | Security-relevant events with severity, outcome, and principal |
| **Metrics** | Request counters, latency histograms, error rates              |

The audit layer is the only one that will block a successful operation if it can't record — guaranteeing every completed MCP call has a corresponding audit record. The others absorb errors silently so observability never breaks your workflow.

## Where Data Lives

Observability data is stored locally on your gateway by default. Trace records, audit events, and metrics all live on-device unless you enable Hub sync or OTLP export.

### Viewing Data

```bash theme={null}
# Web dashboard
ultra dashboard

# Dashboard on custom port
ultra dashboard --address :9090
```

### Hub Sync

When connected to Ultra Hub, traces and audit events are automatically synced to the cloud for team-wide visibility. Local storage is always maintained regardless of Hub connectivity.

## What Gets Recorded

### MCP Operations

| Operation Type  | Triggered By                     |
| --------------- | -------------------------------- |
| `tool_call`     | AI agent calls an MCP tool       |
| `resource_read` | AI agent reads an MCP resource   |
| `prompt_get`    | AI agent retrieves an MCP prompt |
| `tool_list`     | Client lists available tools     |
| `resource_list` | Client lists available resources |
| `prompt_list`   | Client lists available prompts   |

### For Every Operation

* **Trace ID and Span ID** — OpenTelemetry-compatible identifiers for distributed tracing
* **Upstream server** — Which server handled the request
* **Tool/resource/prompt name** — What was called
* **Request payload** — The arguments sent
* **Response payload** — The result returned
* **Duration** — How long the operation took
* **Status** — Success or error
* **User** — User identity (when connected to Ultra Hub)
* **Principal** — The MCP client identity

## Next Steps

<CardGroup cols={2}>
  <Card title="Traces" icon="route" href="/observability/traces">
    Understand trace record structure
  </Card>

  <Card title="Audit Log" icon="clipboard-list" href="/observability/audit-log">
    Security audit events
  </Card>

  <Card title="Dashboard" icon="chart-mixed" href="/observability/dashboard">
    View data in the web dashboard
  </Card>

  <Card title="OTLP Export" icon="arrow-right-from-bracket" href="/observability/otlp-export">
    Export to Jaeger, Grafana, or Datadog
  </Card>
</CardGroup>