coder · ibetitsmike · Aug 19, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 8, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/audit.go b/coderd/audit.go
@@ -22,6 +22,8 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/coderd/searchquery"
 	"github.com/coder/coder/v2/codersdk"
 )
@@ -501,6 +503,18 @@ func (api *API) auditLogIsResourceDeleted(ctx context.Context, alog database.Get
 			api.Logger.Error(ctx, "unable to fetch chat", slog.Error(err))
 		}
 		return false
+	case database.ResourceTypeMCPServerConfig:
+		// MCP server configs are hard-deleted, so a 404 means deleted.
+		_, err := api.Database.GetMCPServerConfigByID(ctx, alog.AuditLog.ResourceID)
+		if xerrors.Is(err, sql.ErrNoRows) {
+			return true
+		}
+		// Config reads are org-scoped, so an auditor can lack read on
+		// the config's organization. That is not worth logging.
+		if err != nil && !dbauthz.IsNotAuthorizedError(err) {
+			api.Logger.Error(ctx, "unable to fetch mcp server config", slog.Error(err))
+		}
+		return false
 	case database.ResourceTypeUserSecret:
 		_, err := api.Database.GetUserSecretByID(ctx, alog.AuditLog.ResourceID)
 		if xerrors.Is(err, sql.ErrNoRows) {
@@ -604,6 +618,17 @@ func (api *API) auditLogResourceLink(ctx context.Context, alog database.GetAudit
 		// Chats are surfaced at /agents/{id}. They are owner-scoped but
 		// not username-scoped in the URL like workspaces or tasks.
 		return fmt.Sprintf("/agents/%s", alog.AuditLog.ResourceID)
+	case database.ResourceTypeMCPServerConfig:
+		actor, ok := dbauthz.ActorFromContext(ctx)
+		if !ok {
+			return ""
+		}
+		// The MCP settings page admits only deployment-config managers,
+		// so emit the link only for callers the page will accept.
+		if err := api.HTTPAuth.Authorizer.Authorize(ctx, actor, policy.ActionUpdate, rbac.ResourceDeploymentConfig); err != nil {
+			return ""
+		}
+		return fmt.Sprintf("/ai/settings/mcp-servers/%s", alog.AuditLog.ResourceID)
 	case database.ResourceTypeUserSecret:
 		// TODO(PLAT-102): point at the user secrets management page once
 		// it ships. Until then, the audit row links nowhere.

diff --git a/coderd/audit/diff.go b/coderd/audit/diff.go
@@ -39,6 +39,7 @@ type Auditable interface {
 		database.AIProviderKey |
 		database.AIGatewayKey |
 		database.Chat |
+		database.MCPServerConfig |
 		database.AuditableGroupAIBudget |
 		database.AuditableUserAIBudgetOverride |
 		database.UserSecret |

diff --git a/coderd/audit/request.go b/coderd/audit/request.go
@@ -1,6 +1,7 @@
 package audit
 
 import (
+	"cmp"
 	"context"
 	"database/sql"
 	"encoding/json"
@@ -154,6 +155,10 @@ func ResourceTarget[T Auditable](tgt T) string {
 		// for display; collisions affect the display label and search
 		// filter but not the primary resource identifier.
 		return typed.ID.String()[:8]
+	case database.MCPServerConfig:
+		// Updates can persist an empty display name; fall back to the slug, or
+		// the ID if both are empty, so the audit entry stays identifiable.
+		return cmp.Or(typed.DisplayName, typed.Slug, typed.ID.String())
 	case database.UserSecret:
 		return typed.Name
 	case database.UserSkill:
@@ -257,6 +262,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
 		return typed.UserID
 	case database.Chat:
 		return typed.ID
+	case database.MCPServerConfig:
+		return typed.ID
 	case database.UserSecret:
 		return typed.ID
 	case database.UserSkill:
@@ -335,6 +342,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
 		return database.ResourceTypeUserAIBudgetOverride
 	case database.Chat:
 		return database.ResourceTypeChat
+	case database.MCPServerConfig:
+		return database.ResourceTypeMCPServerConfig
 	case database.UserSecret:
 		return database.ResourceTypeUserSecret
 	case database.UserSkill:
@@ -425,6 +434,9 @@ func ResourceRequiresOrgID[T Auditable]() bool {
 		// Chats always have a non-null organization_id (since
 		// migration 000467).
 		return true
+	case database.MCPServerConfig:
+		// MCP server configs always carry a non-null organization_id.
+		return true
 	case database.UserSecret:
 		// User secrets are global to the user across organizations.
 		return false

diff --git a/coderd/audit/request_test.go b/coderd/audit/request_test.go
@@ -45,3 +45,20 @@ func TestResourceTarget_ChatTitleNotLeaked(t *testing.T) {
 	require.NotContains(t, target, chat.Title,
 		"ResourceTarget for Chat must not contain the title; it should use a UUID prefix")
 }
+
+func TestResourceTarget_MCPServerConfigSlugFallback(t *testing.T) {
+	t.Parallel()
+
+	config := database.MCPServerConfig{
+		ID:          uuid.UUID{1},
+		DisplayName: "GitHub MCP",
+		Slug:        "github",
+	}
+	require.Equal(t, "GitHub MCP", audit.ResourceTarget(config))
+
+	config.DisplayName = ""
+	require.Equal(t, "github", audit.ResourceTarget(config))
+
+	config.Slug = ""
+	require.Equal(t, config.ID.String(), audit.ResourceTarget(config))
+}
diff --git a/coderd/audit_test.go b/coderd/audit_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/provisioner/echo"
@@ -143,6 +144,57 @@ func TestAuditLogs(t *testing.T) {
 			workspace.OwnerName, workspace.Name, buildNumberString))
 	})
 
+	t.Run("MCPServerConfigAuditLink", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		db, ps := dbtestutil.NewDB(t)
+		client := coderdtest.New(t, &coderdtest.Options{Database: db, Pubsub: ps})
+		user := coderdtest.CreateFirstUser(t, client)
+		auditor, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID, rbac.RoleAuditor())
+		orgAdmin, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID, rbac.ScopedRoleOrgAdmin(user.OrganizationID))
+
+		config := dbgen.MCPServerConfig(t, db, database.MCPServerConfig{
+			OrganizationID: user.OrganizationID,
+		})
+		err := client.CreateTestAuditLog(ctx, codersdk.CreateTestAuditLogRequest{
+			Action:         codersdk.AuditActionCreate,
+			ResourceType:   codersdk.ResourceTypeMCPServerConfig,
+			ResourceID:     config.ID,
+			OrganizationID: user.OrganizationID,
+		})
+		require.NoError(t, err)
+
+		auditorLogs, err := auditor.AuditLogs(ctx, codersdk.AuditLogsRequest{
+			Pagination: codersdk.Pagination{
+				Limit: 1,
+			},
+		})
+		require.NoError(t, err)
+		require.Len(t, auditorLogs.AuditLogs, 1)
+		require.Empty(t, auditorLogs.AuditLogs[0].ResourceLink)
+
+		// Organization admins hold MCP permissions but not the
+		// deployment-config access the settings page requires.
+		orgAdminLogs, err := orgAdmin.AuditLogs(ctx, codersdk.AuditLogsRequest{
+			Pagination: codersdk.Pagination{
+				Limit: 1,
+			},
+		})
+		require.NoError(t, err)
+		require.Len(t, orgAdminLogs.AuditLogs, 1)
+		require.Empty(t, orgAdminLogs.AuditLogs[0].ResourceLink)
+
+		ownerLogs, err := client.AuditLogs(ctx, codersdk.AuditLogsRequest{
+			Pagination: codersdk.Pagination{
+				Limit: 1,
+			},
+		})
+		require.NoError(t, err)
+		require.Len(t, ownerLogs.AuditLogs, 1)
+		require.Equal(t, fmt.Sprintf("/ai/settings/mcp-servers/%s", config.ID), ownerLogs.AuditLogs[0].ResourceLink)
+	})
+
 	t.Run("Organization", func(t *testing.T) {
 		t.Parallel()
 

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000575_audit_mcp_server_config.down.sql b/coderd/database/migrations/000575_audit_mcp_server_config.down.sql
@@ -0,0 +1 @@
+-- No-op, enum values can't be dropped.
diff --git a/coderd/database/migrations/000575_audit_mcp_server_config.up.sql b/coderd/database/migrations/000575_audit_mcp_server_config.up.sql
@@ -0,0 +1,2 @@
+ALTER TYPE resource_type
+	ADD VALUE IF NOT EXISTS 'mcp_server_config';
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/sqlc.yaml b/coderd/database/sqlc.yaml
@@ -275,6 +275,7 @@ sql:
           resource_type_ai_gateway_key: ResourceTypeAIGatewayKey
           mcp_server_config: MCPServerConfig
           mcp_server_configs: MCPServerConfigs
+          resource_type_mcp_server_config: ResourceTypeMCPServerConfig
           mcp_server_user_token: MCPServerUserToken
           mcp_server_user_tokens: MCPServerUserTokens
           mcp_server_tool_snapshot: MCPServerToolSnapshot

diff --git a/coderd/mcp.go b/coderd/mcp.go
@@ -19,6 +19,7 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog/v3"
+	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
@@ -248,6 +249,15 @@ func (api *API) createMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
 	organization := httpmw.OrganizationParam(r)
+	auditor := api.Auditor.Load()
+	aReq, commitAudit := audit.InitRequest[database.MCPServerConfig](rw, &audit.RequestParams{
+		Audit:          *auditor,
+		Log:            api.Logger,
+		Request:        r,
+		Action:         database.AuditActionCreate,
+		OrganizationID: organization.ID,
+	})
+	defer commitAudit()
 	if !api.Authorize(r, policy.ActionCreate, rbac.ResourceMCPServerConfig.InOrg(organization.ID)) {
 		httpapi.Forbidden(rw)
 		return
@@ -441,6 +451,8 @@ func (api *API) createMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	aReq.New = inserted
+
 	httpapi.Write(ctx, rw, http.StatusCreated, convertMCPServerConfig(inserted))
 }
 
@@ -544,6 +556,21 @@ func (api *API) getMCPServerConfigForMutation(rw http.ResponseWriter, r *http.Re
 func (api *API) updateMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
+	auditor := api.Auditor.Load()
+	aReq, commitAudit := audit.InitRequest[database.MCPServerConfig](rw, &audit.RequestParams{
+		Audit:   *auditor,
+		Log:     api.Logger,
+		Request: r,
+		Action:  database.AuditActionWrite,
+	})
+	defer commitAudit()
+
+	// Set Old before the write-authz check so a write-denied 403 is
+	// audited. Read-denied callers were already concealed with 404 by
+	// the param middleware and never reach this handler.
+	aReq.Old = httpmw.MCPServerConfigParam(r)
+	aReq.UpdateOrganizationID(aReq.Old.OrganizationID)
+
 	existing, ok := api.getMCPServerConfigForMutation(rw, r, policy.ActionUpdate)
 	if !ok {
 		return
@@ -593,14 +620,15 @@ func (api *API) updateMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 
 	var updated database.MCPServerConfig
 	err := api.Database.InTx(func(tx database.Store) error {
-		// Lock and re-fetch the row so omitted fields come from the latest
-		// version and grant invalidation serializes with in-flight OAuth
-		// callbacks verifying the same config.
+		// Lock and re-fetch the row so omitted fields and the audit baseline
+		// match the row this update replaces, and so grant invalidation
+		// serializes with in-flight OAuth callbacks verifying the config.
 		current, err := tx.GetMCPServerConfigByIDForUpdate(ctx, existing.ID)
 		if err != nil {
 			return err
 		}
 		existing = current
+		aReq.Old = current
 
 		touchesUserOIDC := existing.AuthType == "user_oidc" ||
 			(req.AuthType != nil && *req.AuthType == "user_oidc")
@@ -873,6 +901,8 @@ func (api *API) updateMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	aReq.New = updated
+
 	httpapi.Write(ctx, rw, http.StatusOK, convertMCPServerConfig(updated))
 }
 
@@ -888,12 +918,42 @@ func (api *API) updateMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 // EXPERIMENTAL: this endpoint is experimental and is subject to change.
 func (api *API) deleteMCPServerConfig(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
+	auditor := api.Auditor.Load()
+	aReq, commitAudit := audit.InitRequest[database.MCPServerConfig](rw, &audit.RequestParams{
+		Audit:   *auditor,
+		Log:     api.Logger,
+		Request: r,
+		Action:  database.AuditActionDelete,
+	})
+	defer commitAudit()
+
+	// Set Old before the write-authz check so a write-denied 403 is
+	// audited. Read-denied callers were already concealed with 404 by
+	// the param middleware and never reach this handler.
+	aReq.Old = httpmw.MCPServerConfigParam(r)
+	aReq.UpdateOrganizationID(aReq.Old.OrganizationID)
+
 	config, ok := api.getMCPServerConfigForMutation(rw, r, policy.ActionDelete)
 	if !ok {
 		return
 	}
 
-	if err := api.Database.DeleteMCPServerConfigByID(ctx, config.ID); err != nil {
+	err := api.Database.InTx(func(tx database.Store) error {
+		// Re-fetch under a row lock so the audit record describes the
+		// row this request actually removes, not a middleware snapshot
+		// that a concurrent update may have made stale.
+		current, err := tx.GetMCPServerConfigByIDForUpdate(ctx, config.ID)
+		if err != nil {
+			return err
+		}
+		aReq.Old = current
+		return tx.DeleteMCPServerConfigByID(ctx, current.ID)
+	}, nil)
+	if err != nil {
+		if httpapi.Is404Error(err) {
+			httpapi.ResourceNotFound(rw)
+			return
+		}
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Failed to delete MCP server config.",
 			Detail:  err.Error(),
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		ALTER TYPE resource_type
		ADD VALUE IF NOT EXISTS 'mcp_server_config';