Log MCP origin of Duo sessions to mcp.log

Alex Filatovrequested to merge
630113-log-mcp-origin-for-duo-sessions into master

What does this MR do and why?

This MR writes a log line to mcp.log when a Duo session is created over MCP.

Before this change, the MCP origin of a Duo session was only in the database and in Snowflake. It was not in Kibana. Now it is also in the logs.

The work item scope was reduced in a comment. The database marker and the internal event were already done in !253728 (merged) and !254746 (merged). The Orbit MCP endpoint cannot start sessions, so it is not a gap. This MR does the remaining work.

  • Ai::DuoWorkflows::CreateWorkflowService logs one line through Gitlab::Mcp::Logger when the new session has source_type mcp.
  • The log is in the shared create service. It covers all creation paths: AI Catalog flows, GitLab flows, and foundational agents.
  • The line has these fields: message, event_name, ai_component, source_type, duo_workflow_id, and gl_user_id.
  • The line has the same correlation_id as the MCP tool_call line from the same request.
  • The fields are always logged. Expanded AI logging does not control them.
  • doc/administration/logs/_index.md describes the new line in the mcp.log section.
  • doc/development/duo_agent_platform/mcp/_index.md has a new section, "Filter Duo sessions by MCP origin". It shows how to filter in the database, Snowflake, and Kibana.

The log volume is very small. There is one line for each session created over MCP.

There is no feature flag and no database change.

References

Screenshots or screen recordings

There is no UI change. This is an example of the new log line in mcp.log:

{
  "severity": "INFO",
  "time": "2026-10-06T10:00:00.000Z",
  "correlation_id": "29d8d33c-b727-4910-98c9-5b029299f323",
  "meta.caller_id": "POST /api/:version/mcp",
  "meta.feature_category": "mcp_server",
  "message": "Duo session created over MCP",
  "event_name": "duo_session_created",
  "ai_component": "mcp_server",
  "gl_user_id": 1,
  "source_type": "mcp",
  "duo_workflow_id": 123
}

How to set up and validate locally

  1. Use a GDK with GitLab Duo Agent Platform and the MCP server working. You also need a project where you can start a Duo session. You need the Developer role or higher, and a runner for Duo sessions.

  2. In a terminal, follow the log. Run this from the gitlab directory of the GDK:

    tail -f log/mcp.log | grep duo_session_created

  3. Start a session over MCP. For example, connect an MCP client such as Claude Code or Cursor to http://gdk.test:3000/api/v4/mcp. Ask it to call the start_duo_session tool with a project and a goal.

    You can also send a JSON-RPC request with curl. The token needs the mcp scope.

    curl --request POST "http://gdk.test:3000/api/v4/mcp" \
  --header "Authorization: Bearer <your_access_token>" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json, text/event-stream" \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"start_duo_session","arguments":{"project_id":"<group/project>","goal":"Add a README section"}}}'

  4. Check that mcp.log has a duo_session_created line. It should have source_type set to mcp. The session ID should be in duo_workflow_id.

  5. Optional: check that the tool_call line for start_duo_session has the same correlation_id.

  6. Open the Rails console with bin/rails console. Run this command:

    Ai::DuoWorkflows::Workflow.source_mcp.last

    It should return the same session as duo_workflow_id in the log line.

  7. Do a negative check. Start a session another way, for example from the GitLab UI or the Duo CLI. No duo_session_created line should be added to mcp.log.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports