diff --git a/runtimes/google/ipc/server.go b/runtimes/google/ipc/server.go
index 522ead9..c30c097 100644
--- a/runtimes/google/ipc/server.go
+++ b/runtimes/google/ipc/server.go
@@ -22,6 +22,8 @@
 	"veyron.io/veyron/veyron2/vtrace"
 
 	"veyron.io/veyron/veyron/lib/netstate"
+	"veyron.io/veyron/veyron/lib/stats"
+	"veyron.io/veyron/veyron/runtimes/google/ipc/stream/vc"
 	"veyron.io/veyron/veyron/runtimes/google/lib/publisher"
 	inaming "veyron.io/veyron/veyron/runtimes/google/naming"
 	ivtrace "veyron.io/veyron/veyron/runtimes/google/vtrace"
@@ -68,6 +70,7 @@
 
 func InternalNewServer(ctx context.T, streamMgr stream.Manager, ns naming.Namespace, store *ivtrace.Store, opts ...ipc.ServerOpt) (ipc.Server, error) {
 	ctx, _ = ivtrace.WithNewSpan(ctx, "NewServer")
+	statsPrefix := naming.Join("ipc", "server", "routing-id", streamMgr.RoutingID().String())
 	s := &server{
 		ctx:         ctx,
 		streamMgr:   streamMgr,
@@ -75,20 +78,40 @@
 		listeners:   make(map[stream.Listener]*dhcpListener),
 		stoppedChan: make(chan struct{}),
 		ns:          ns,
-		stats:       newIPCStats(naming.Join("ipc", "server", streamMgr.RoutingID().String())),
+		stats:       newIPCStats(statsPrefix),
 		traceStore:  store,
 	}
+	var (
+		principal security.Principal
+		blessings security.Blessings
+	)
 	for _, opt := range opts {
 		switch opt := opt.(type) {
 		case stream.ListenerOpt:
 			// Collect all ServerOpts that are also ListenerOpts.
 			s.listenerOpts = append(s.listenerOpts, opt)
+			switch opt := opt.(type) {
+			case vc.LocalPrincipal:
+				principal = opt.Principal
+			case options.ServerBlessings:
+				blessings = opt.Blessings
+			}
 		case options.ServesMountTable:
 			s.servesMountTable = bool(opt)
 		case options.ReservedNameDispatcher:
 			s.reservedOpt = opt
 		}
 	}
+	blessingsStatsName := naming.Join(statsPrefix, "security", "blessings")
+	if blessings != nil {
+		// TODO(caprita): revist printing the blessings with %s, and
+		// instead expose them as a list.
+		stats.NewString(blessingsStatsName).Set(fmt.Sprintf("%s", blessings))
+	} else if principal != nil { // principal should have been passed in, but just in case.
+		stats.NewStringFunc(blessingsStatsName, func() string {
+			return fmt.Sprintf("%s (default)", principal.BlessingStore().Default())
+		})
+	}
 	return s, nil
 }
 
diff --git a/runtimes/google/ipc/stats.go b/runtimes/google/ipc/stats.go
index 5f6f2ed..334ce23 100644
--- a/runtimes/google/ipc/stats.go
+++ b/runtimes/google/ipc/stats.go
@@ -48,7 +48,7 @@
 	defer s.mu.Unlock()
 	m, ok := s.methods[method]
 	if !ok {
-		name := naming.Join(s.prefix, method, "latency-ms")
+		name := naming.Join(s.prefix, "methods", method, "latency-ms")
 		s.methods[method] = &perMethodStats{
 			latency: stats.NewHistogram(name, histogram.Options{
 				NumBuckets:         25,
diff --git a/runtimes/google/rt/security.go b/runtimes/google/rt/security.go
index 67814f1..86223d1 100644
--- a/runtimes/google/rt/security.go
+++ b/runtimes/google/rt/security.go
@@ -6,6 +6,7 @@
 	"os/user"
 	"strconv"
 
+	"veyron.io/veyron/veyron/lib/stats"
 	vsecurity "veyron.io/veyron/veyron/security"
 	"veyron.io/veyron/veyron/security/agent"
 
@@ -18,6 +19,16 @@
 }
 
 func (rt *vrt) initSecurity(credentials string) error {
+	if err := rt.setupPrincipal(credentials); err != nil {
+		return err
+	}
+	stats.NewString("security/principal/key").Set(rt.principal.PublicKey().String())
+	stats.NewStringFunc("security/principal/blessingstore", rt.principal.BlessingStore().DebugString)
+	stats.NewStringFunc("security/principal/blessingroots", rt.principal.Roots().DebugString)
+	return nil
+}
+
+func (rt *vrt) setupPrincipal(credentials string) error {
 	if rt.principal != nil {
 		return nil
 	}
diff --git a/tools/debug/test.sh b/tools/debug/test.sh
index b3078b0..8c38207 100755
--- a/tools/debug/test.sh
+++ b/tools/debug/test.sh
@@ -62,7 +62,7 @@
   shell_test::assert_eq "${GOT}" "${WANT}" "${LINENO}"
 
   # Test stats read.
-  GOT=$("${DEBUG_BIN}" stats read "${EP}/__debug/stats/ipc/server/*/ReadLog/latency-ms" 2> "${DBGLOG}" | wc -l) \
+  GOT=$("${DEBUG_BIN}" stats read "${EP}/__debug/stats/ipc/server/routing-id/*/methods/ReadLog/latency-ms" 2> "${DBGLOG}" | wc -l) \
     || (dumplogs "${DBGLOG}"; shell_test::fail "line ${LINENO}: failed to run debug")
   shell_test::assert_gt "${GOT}" "0" "${LINENO}"
 
@@ -70,7 +70,7 @@
   local TMP=$(shell::tmp_file)
   touch "${TMP}"
   local -r DEBUG_PID=$(shell::run_server "${shell_test_DEFAULT_SERVER_TIMEOUT}" "${TMP}" "${DBGLOG}" \
-    "${DEBUG_BIN}" stats watch -raw "${EP}/__debug/stats/ipc/server/*/ReadLog/latency-ms")
+    "${DEBUG_BIN}" stats watch -raw "${EP}/__debug/stats/ipc/server/routing-id/*/methods/ReadLog/latency-ms")
   shell::timed_wait_for "${shell_test_DEFAULT_MESSAGE_TIMEOUT}" "${TMP}" "ReadLog/latency-ms"
   kill "${DEBUG_PID}"
   grep -q "Count:1 " "${TMP}" || (dumplogs "${TMP}"; shell_test::fail "line ${LINENO}: failed to find expected output")