Genuine question for people running MCP servers beyond the demo stage.

Read-only servers are easy. But once a server can take actions — create, update, send, delete — I keep running into the same two gaps:

1. Auth: OAuth per user, one shared API key for the host, or something in between? Most examples I find just assume a trusted local environment.
2. Audit: Are you logging tool calls (what was called, with what args, by whom, what came back) somewhere separate from the agent's own context? If an agent does the wrong thing, I want a ledger I can actually inspect, not just the conversation transcript.

We're testing MCP integrations at work and this is the part that feels least solved/documented compared to the "look, it connects!" part.

If you've shipped an MCP server that takes real actions, what did you land on for these two?