When an auditor asks for proof that only authorized users touched a critical MCP server, the answer is often “we have no logs.” The missing evidence can stall a SOC 2 audit, trigger costly re‑work, and leave the organization exposed to undetected misuse. Without a reliable trail, a single compromised credential can lead to data exfiltration, service disruption, and a breach report that costs millions.
Most teams today connect to MCP servers on Azure by distributing static service‑account keys or embedding passwords in CI pipelines. Engineers log in directly with those secrets, and the servers themselves rarely emit detailed request logs. The result is a flat‑file of occasional health checks, no per‑user attribution, and no way to prove that a privileged operation was reviewed before execution.
Why soc 2 compliance matters for MCP servers
SOC 2 expects continuous evidence of access control, change management, and auditability. The criteria demand that every privileged action be traceable to an identity, that approvals be documented, and that sensitive data be protected in transit. In the current model, the “who, what, and when” information lives only in the memory of a few engineers, not in an immutable record that auditors can inspect.
The immediate fix many organizations apply is to tighten IAM policies around the static keys. While that reduces the blast radius, it does not add any visibility into who actually used the key, what command was run, or whether the output contained sensitive fields. The request still travels straight to the MCP server, bypassing any checkpoint that could enforce masking, block dangerous commands, or require a human approval step.
Introducing a data‑path gateway for continuous evidence
hoop.dev places a Layer 7 gateway between the client and the MCP server. The gateway authenticates each request against an OIDC or SAML identity provider, then forwards the traffic to the server through an agent that resides inside the Azure network. Because the gateway is the only path the traffic can take, it becomes the enforcement point for every SOC 2 control.
hoop.dev records each session, captures the exact command line, and stores the response in a persistent audit log. It masks sensitive fields in real time, so even if a privileged query returns credit‑card numbers, the audit log contains only the masked version. When a command matches a risky pattern, hoop.dev can pause the request and route it to a designated approver, creating a documented approval record before the action proceeds.