fix(mcp): keep the deployment source on additional servers and audit MCP calls as MCP

CHANGELOG.md

@@ -9,7 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 ### Fixed
 
 - Handle an existing Cloudflare DNS record with a different IP when Coolify adds the DNS record of a new domain automatically. Coolify now replaces the record when it created the record and no other resource uses it. Otherwise it opens the **Configure DNS** dialog, where you can replace the record, and the domain shows the conflict instead of "Not checked"
-- Save deployments started through the MCP server as MCP deployments, not as API deployments. The deployment list shows them with the **MCP** source and filter, and the API and MCP deployment data have a new `is_mcp` field
+- Save deployments started through the MCP server as MCP deployments, not as API deployments. The deployment list shows them with the **MCP** source and filter, and the API and MCP deployment data have a new `is_mcp` field. The deployments to additional servers keep the source of the main deployment, and the audit log records actions that MCP tools do through the API as MCP events
 
 ## [v4.6.0] - 2026-11-02
 

app/Jobs/ApplicationDeploymentJob.php

@@ -3297,12 +3297,15 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     deployment_uuid: $deployment_uuid,
                     application: $this->application,
                     commit: $this->commit,
+                    is_webhook: (bool) $this->application_deployment_queue->is_webhook,
+                    is_api: (bool) $this->application_deployment_queue->is_api,
                     no_questions_asked: true,
                     server: $server,
                     destination: $destination,
                     rollback: $this->rollback,
                     docker_registry_image_tag: $this->application_deployment_queue->docker_registry_image_tag,
                     parent_deployment_uuid: $this->deployment_uuid,
+                    is_mcp: (bool) $this->application_deployment_queue->is_mcp,
                 );
             } catch (Throwable $e) {
                 \Log::warning("Deployment {$this->deployment_uuid} could not queue the deployment to {$server->name}: {$e->getMessage()}");

app/Models/ApplicationDeploymentQueue.php

@@ -112,14 +112,10 @@ class ApplicationDeploymentQueue extends Model
                 return;
             }
 
+            // The API and MCP cancel paths do not fire model events and record their own audit event.
             $application = $deployment->application;
-            $source = match (true) {
-                (bool) $deployment->is_mcp => 'mcp',
-                (bool) $deployment->is_api => 'api',
-                default => 'ui',
-            };
 
-            auditLog("{$source}.deployment.cancelled", [
+            auditLog('ui.deployment.cancelled', [
                 'team_id' => $application?->team()?->id,
                 'application_uuid' => $application?->uuid,
                 'application_name' => $application?->name,

bootstrap/helpers/audit.php

@@ -16,6 +16,11 @@ if (! function_exists('auditLog')) {
      */
     function auditLog(string $event, array $context = [], string $level = 'info'): void
     {
+        // MCP tools also call the REST API controllers through an internal request.
+        if (str_starts_with($event, 'api.') && app()->bound('request') && request()->attributes->get('mcp_rest_bridge') === true) {
+            $event = 'mcp.'.substr($event, 4);
+        }
+
         if (! shouldRecordAuditEvent($event, $context)) {
             return;
         }