Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

🎃 Export the audit log as CSV or JSON from /logs

Abierto
  • ¿Algo no está bien?
#849 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
backend-api-design, documentation, frontend

Línea de trabajo

Start with the list filters in packages/backend/src/audit/audit.controller.ts and orgScope()/getRecentInvocations() in audit.service.ts; then read the logs page and audit client paths listed in the issue. Run the backend tests with cd packages/backend && npm test and add the specified CSV utility tests. Done means the streamed export honors filters, admin and organization restrictions, row cap and truncation header, with the frontend button and API docs updated.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement hacktoberfest help wanted

Part of the October Challenge #846.

Why

The Audit Log page (/logs) only lets you page through tool calls 50 at a time. Admins who need to send a compliance report, look into an incident in a spreadsheet, or attach evidence to a support ticket have nothing to download. Most API gateways and MCP platforms (Kong, Tyk, Apigee, Postman monitors) have a "download logs" button. This issue adds a streamed export that applies the filters the user already has set.

Self-hosted vs Cloud

  • Self-hosted: enabled in Community and Business. Not a Business feature: do not touch ee/.
  • Cloud (DEPLOYMENT_MODE=cloud): enabled, behaves the same. Cloud is multi-tenant, so the export must always be scoped to the caller's organization: refuse with 403 when req.user.organizationId is not set, and never fall back to unscoped rows. One tenant can hold millions of rows (see the comment in bound-payload.ts), so the row cap and the throttle are required.
  • Who can use it: ADMIN only (@Roles('ADMIN') + RolesGuard). Every role can view the list today, but a bulk download of the whole org's call payloads is a bigger step, so it is limited to admins. Hide the button for other roles. The data is always filtered to the caller's organization.

What to build

  1. Backend: GET /api/audit/invocations/export?format=csv|json in audit.controller.ts. It takes the same filters as the list (status, search, connectorId, mcpServerId, toolId) plus optional ISO from/to on createdAt.
  2. Move the where construction out of getRecentInvocations() into one helper (e.g. buildInvocationWhere(filters)) that both the list and the export call, so the two cannot drift apart.
  3. Stream the response: read in batches (e.g. 1000 rows, keyset pagination on createdAt/id, newest first) and write each batch to res. Never load everything into memory. Cap at AUDIT_EXPORT_MAX_ROWS (default 50000). Send X-Export-Truncated: true when the cap was hit (do a count first). Set Content-Disposition: attachment; filename="anythingmcp-logs-YYYY-MM-DD.csv". Throttle with @Throttle({ default: { limit: 5, ttl: 60_000 } }).
  4. Columns (only data the page already shows): createdAt (ISO), status, durationMs, tool, connector, connectorType, mcpServer, userEmail, authMethod, apiKeyName, error. JSON additionally includes the input/output excerpts exactly as stored. Do not export intent, costMicros, usedProxy, the raw clientInfo blob, internal ids other than the invocation id, or anything else the UI does not show.
  5. CSV safety: RFC 4180 quoting (wrap in quotes, double any "), and escape formula injection: prefix any cell that starts with =, +, -, @, tab or CR with '. Put this in a small pure function (e.g. packages/backend/src/audit/csv.util.ts) so it can be unit-tested. JSON: either one array or NDJSON. Pick one and document it.
  6. Frontend: an "Export" button (with a CSV/JSON choice) in the page actions next to Refresh. Call it with the current filters, fetch with the Bearer token, download the result as a Blob (same pattern as connectors/page.tsx:139-149), and show a notice when X-Export-Truncated is set. Add an audit.exportInvocations() helper in lib/api.ts. The shared request() helper parses JSON, so it can't be used for the file.

Where to look

  • packages/backend/src/audit/audit.controller.ts:13-38: the list endpoint and its filters.
  • packages/backend/src/audit/audit.service.ts:176-225: orgScope() and getRecentInvocations().
  • packages/backend/src/audit/bound-payload.ts:16: _amcp_truncated marker. Stored payloads are excerpts, so don't try to recover full bodies.
  • packages/backend/src/knowledge-graph/kg.controller.ts:22,52: RolesGuard + @Roles('ADMIN') pattern.
  • packages/backend/src/auth/login.controller.ts:137: @Throttle pattern.
  • packages/backend/src/auth/login.controller.ts:87: @Res() usage with Express.
  • packages/frontend/src/app/logs/page.tsx:116-134 (filters), :183-207 (the exportButton variable is actually Refresh; rename it), :204-208 (actions).
  • packages/frontend/src/app/settings/layout.tsx:54: user?.role === 'ADMIN' check.
  • packages/frontend/src/lib/api.ts:735-747: audit client.

Acceptance criteria

  • Export applies every active filter, and only the caller's org rows are ever returned (unit test: organizationId is in the where; a missing org gives 403).
  • Non-admins get 403, and the button is hidden for them.
  • Results are streamed in batches, the row cap is honored, and the truncation header is set.
  • csv.util.spec.ts covers quoting, newlines inside cells, and =cmd|' /C calc'!A0-style injection.
  • audit.service.spec.ts / a new controller spec covers the shared where-builder (cd packages/backend && npm test).
  • docs/api-reference.md Audit section (line 219) documents the endpoint. Also fix the existing examples at lines 226-236, which use toolName/from/to params the list endpoint does not support.

Out of scope

  • Scheduled exports, emailing exports, S3/SIEM push.
  • Exporting security events or product events.
  • Changing what is stored in tool_invocations, or the retention policy.

Size

M (1–2 days)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #846.

Lenguaje dominante
TypeScript
Estrellas
856
Forks
82
Merge medio
5 h 18 min
PR fusionados (30 d)
162

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de HelpCode-ai/anythingmcp

Todos los issues de HelpCode-ai/anythingmcp

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.