Stream logs to external sinks

Log streaming forwards your app's MCP execution logs to an external observability system — DataDog, Splunk (via the HTTP Event Collector), or any generic HTTP endpoint — so MCP activity sits alongside the rest of your telemetry. Each app can have multiple destinations, and only privacy-safe fields are sent.

Log streaming is an Enterprise feature. When it is enabled for your workspace, a Log streaming entry appears in the app sidebar.

Because a destination forwards execution logs to an external endpoint with a credential you provide, only workspace owners can add, edit, or remove destinations. Members can view the current configuration but not change it.

Adding a destination

1. Open your app and click Log streaming in the sidebar.

2. Click Add destination and fill in:

   • Name — a label so you can tell destinations apart (e.g. "DataDog prod").

   • Destination — DataDog, Splunk (HEC), or Generic HTTP.

   • DataDog site (DataDog only) — the intake site for your DataDog account (datadoghq.com, datadoghq.eu, us3.datadoghq.com, etc.). It must match the site shown in your DataDog URL.

   • Endpoint URL (Splunk / Generic HTTP) — the https:// endpoint to POST to. For Splunk, enter your HEC base URL — /services/collector is appended automatically.

   • Auth header name (Generic HTTP only, optional) — leave blank to send Authorization: Bearer <token>, or set a custom header (e.g. X-API-Key) to send the raw token instead.

   • API key / token — the DataDog API key, Splunk HEC token, or bearer token for your HTTP endpoint.

   • Only forward errors / Minimum status code — optionally restrict which calls are forwarded (e.g. errors only, or status ≥ 500).

3. Leave Enabled on, then click Create sink.

Where to get the credential

• DataDog — Organization Settings → API Keys.

• Splunk — Settings → Data inputs → HTTP Event Collector → New Token.

• Generic HTTP — whatever token your collector expects.

What gets sent

Only the privacy-safe fields from the Execution logs are forwarded — never tokens, request/response bodies, or authorization headers. Each record includes the tool name, status code, latency, error code, the MCP client name/version, the LLM model (when reported), a hashed end-user key, and the timestamp.

Only published servers are streamed — draft and disabled servers do not generate forwarded logs.

How delivery works

FlowCP polls for new execution logs in the background and delivers them in batches roughly once a minute, so expect up to about a minute of latency. Each destination tracks its own position, so a destination added today only forwards logs created from that point on — it does not backfill history. Failed batches are retried automatically; if delivery keeps failing, the destination shows a Delivery error with the latest message.

For your security, the API key/token is encrypted at rest and never shown again once saved. When editing a destination, the secret field shows Configured — paste a new value to replace it, or click Remove to clear it.

Endpoint URLs are validated to block private and reserved network ranges, so a destination can only ever reach a public host.

Editing and removing

Click Edit on a destination to change its settings or filters, or toggle Enabled to pause streaming without deleting it. Click the trash icon to remove a destination entirely.