Solutions

A straight answer to "what did my agent do?"

Every call your agents make becomes a complete, queryable record — who, what, when, and which rule decided — without keeping data you didn't ask to keep.

Get started See how it works

Every call, on the record.

Each call your agents make lands here as one searchable row — who ran it, what it did, and which rule decided — the instant it happens.

Audit log — screenshot placeholder
Every call, one row — searchable the moment it happens.

"It called the API" isn't an answer.

Provider logs and after-the-fact guesswork don't hold up when someone actually asks what happened.

Logs tell you an API was called

Not which agent made the call, under which rule it was allowed, or with what arguments. That gap is exactly what someone asks about first.

Compliance needs proof, not memory

Audits and incident response need to show who decided and on what rule — not a reconstruction pieced together after the fact.

Logging everything is a liability

Storing every request and response by default — arguments, outputs, all of it — is exactly the kind of data hoard most teams don't want to be responsible for.

What one row actually holds.

Every resolved call becomes one small, immutable record — who, what, when, and which rule decided. By default it carries no request or response body: here's what's in an audit log.

{
  "ts":          "2026-08-25T14:03:11Z",
  "agent":       "batch-importer",
  "server":      "stripe",
  "tool":        "refund",
  "method":      "tools/call",
  "verdict":     "deny",
  "rule":        "block-large-refunds",
  "reason":      "amount_over_threshold",
  "status":      "blocked",
  "duration_ms": 12,
  "client_ip":   "203.0.113.7",
  "req_bytes":   214,
  "resp_bytes":  0,
  "request":     null,
  "response":    null
}

Metadata by default, payload-blind by design. The request / response fields are null unless you switch on capture for that one rule — and even then Meandr stores the body encrypted and never reads it. What decided the call is always on the record; see how it fits into MCP governance.

How it works

A record for every call, kept light by default.

Every call is written down as it happens. What's kept — and how much of it — is something you decide, rule by rule.

01

Every call recorded

No gaps.

Allowed, blocked, or held for approval — each call becomes an audit record: who made it, what it targeted, when it happened, the caller's IP, and which rule decided.

You get: a complete trail, with nothing left out by accident.

02

Metadata by default

The fact, not the contents.

Out of the box, the record shows that a call happened and what decided it — not the request or response contents. Nothing extra to explain away later.

You get: a lean record that answers most questions on its own.

03

Opt-in capture

Only where you ask for it.

Need the full request and response for a particular rule? Turn on capture for that rule and it's stored encrypted. Everywhere else, it stays off.

You get: detail exactly where you've decided you need it.

Questions you'd ask anyway.

Do you store the content of every call by default?
No. By default Meandr records only the metadata — who, what, when, which rule decided — not the actual request or response. Full capture is opt-in, per rule, and stored encrypted when you turn it on.
How long is history kept?
Retention depends on your plan — see the Pricing page for details.
Can I export the audit log?
Yes — and pulling your own logs out isn't gated behind a plan. On any plan you can download a whole period as one archive of raw, per-day records straight from your project — it's your data, not a premium feature. On Business you can additionally run deeper log queries and export the result as a CSV.
Is the audit trail queryable?
Yes — the record is searchable. Deeper log queries are available on the Business plan.

Get a straight answer, every time someone asks.

Point your agent at one endpoint and you're governed in minutes — no code changes, no proxy to run.

Get started

Questions? Email us