diff --git a/litellm/proxy/_experimental/mcp_server/server.py b/litellm/proxy/_experimental/mcp_server/server.py
index 55a0fa083c0..5c814774fda 100644
--- a/litellm/proxy/_experimental/mcp_server/server.py
+++ b/litellm/proxy/_experimental/mcp_server/server.py
@@ -3064,6 +3064,8 @@ if MCP_AVAILABLE:
                 mcp_server_logo_url=mcp_info.get("logo_url"),
                 namespaced_tool_name=namespaced_tool_name,
                 mcp_session_id=session_id,
+                mcp_auth_mode=mcp_server.auth_type,
+                mcp_server_resource=mcp_server.url,
             )
         else:
             return StandardLoggingMCPToolCall(
diff --git a/litellm/types/utils.py b/litellm/types/utils.py
index 908f5b76424..e71c42084d1 100644
--- a/litellm/types/utils.py
+++ b/litellm/types/utils.py
@@ -2523,6 +2523,20 @@ class StandardLoggingMCPToolCall(TypedDict, total=False):
     the client is driving a stateful session. Absent for stateless calls.
     """
 
+    mcp_auth_mode: Optional[str]
+    """
+    The server's auth_type for this call (e.g. `true_passthrough`, `oauth_delegate`,
+    `oauth2`). For the client-forwarded token modes this records that the caller's own
+    upstream token was relayed, so an audit can attribute a relayed request to its mode
+    without logging any credential.
+    """
+
+    mcp_server_resource: Optional[str]
+    """
+    The upstream MCP server URL (the RFC 8707 resource) the tool call was forwarded to.
+    Records which upstream received a relayed request; never a credential.
+    """
+
 
 class StandardLoggingVectorStoreRequest(TypedDict, total=False):
     """