---
title: Revoke an MCP client or connection
description: Remove an individual connection or an entire MCP client from Agent Builder to cut off OAuth access for a user or application.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/revoke-oauth-client
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
---

# Revoke an MCP client or connection
Revoking OAuth access in Elastic Agent Builder immediately cuts off an MCP host's ability to use the Agent Builder tools. You can revoke access at two levels:
- **Revoke a connection**: Removes one user's authorized session for an MCP client, while leaving the client registered. The user can reconnect by going through the consent flow again.
- **Revoke an MCP client**: Revokes the entire client and all its connections. Users whose connections are removed can no longer connect until a new client is created.

Organization owners and project administrators can revoke connections for projects they administer from the Elastic Cloud Console. Users can also revoke connections they created themselves from the Elastic Cloud Console. Refer to [Manage application connections](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/manage-app-connections).
<warning>
  Removing a user from your identity provider does **not** automatically revoke that user's connections. Revoke their connections manually when offboarding.
</warning>


## Before you begin

Revoking connections or clients from the **Application connections** page in Kibana requires the `manage_security` cluster privilege. A user with only `read_security` can view connections but can't revoke them.

## Revoke a connection

To revoke a single connection:
1. In Kibana, go to **Admin and settings** → **Application connections**.
   You can also reach this page from **Agent Builder** → **Tools library** → **Manage MCP** → **Manage MCP clients (OAuth)** by clicking **Manage application connections**.
2. Find the connection. In **Group by client** view, expand a client row to see its connections. Switch to **List view** to see all connections in a flat list.
3. Click **Revoke** in the connection's row.
4. Review the details in the confirmation dialog, then click **Revoke**.

The connection is revoked immediately. The MCP client stays registered and can accept new connections. Applications can be reconnected at any time by going through the consent flow again.

## Revoke multiple connections

To revoke several connections at once:
1. In Kibana, go to **Admin and settings** → **Application connections**.
   You can also reach this page from **Agent Builder** → **Tools library** → **Manage MCP** → **Manage MCP clients (OAuth)** by clicking **Manage application connections**.
2. Select the checkbox next to each connection you want to revoke. To select all connections for a client, select the checkbox in the client's row.
3. Click **Revoke *N* connections**.
4. Review the list in the confirmation dialog, then click **Revoke**.


## Revoke an MCP client

Revoking a client immediately terminates all its connections. The client is no longer listed in Agent Builder, and existing OAuth tokens for those connections stop working at the next validation.
To revoke an MCP client:
1. In Kibana, go to **Agent Builder** → **Tools library**, click **Manage MCP**, and select **Manage MCP clients (OAuth)**.
2. Find the client and click **Revoke** in its row.
3. In the **Revoke [client name]?** dialog, review the number of active connections that will be affected.
4. In the **MCP client name** field, type the client name exactly as shown to confirm, then click **Revoke**.

After revocation, users can no longer connect with that client until a new MCP client is created.
To restore access after revoking a client, you can [create a new MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/create-oauth-client) and distribute the new credentials to users.

## Related pages

See also:
- [OAuth for MCP clients](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/oauth-clients)
- [Create an MCP client in Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/create-oauth-client)
- [Connect an MCP host to an MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/connect-mcp-host)
- [Manage application connections](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/manage-app-connections): Revoke connections at the organization level in the Elastic Cloud Console.