Loading

Manage MCP client connections

The Application connections page in the Elastic Cloud Console gives organization administrators a single place to audit and revoke MCP client connections that members of your organization have authorized across their Serverless projects.

Note

During technical preview, application connections cover MCP clients only, and connected applications get read-only access through Elasticsearch Query Language (ES|QL)-based tools. Support is limited to Serverless projects.

To create an MCP client or connect an MCP host such as Claude Desktop, see Connect an MCP host to an MCP client in the Agent Builder documentation. This page covers organization-level management only.

To access this page, open Organization → Security settings → Application connections in the Elastic Cloud Console. What you can see and revoke depends on your role:

  • Organization owners see every application connection in the organization.
  • Other users see connections for the projects they administer, plus any connections they authorized themselves.

The page offers two views, toggled by the Group by client and List view buttons:

  • Group by client (default for organization owners) — lists each MCP client with a count of its connections. Expand a client row to see individual connections.
  • List view — shows all connections in a flat, sortable table.

The Application connections page shows each MCP client and its connections. In grouped view, expand a client to see its individual connections. Each connection row shows the following details:

Column Description
Connection name The name of the connection, derived from the MCP client name.
Authorization date When the user authorized the connection.
Connected by The email address of the user who authorized the connection.
Status The current state of the connection. See Connection statuses.
Note

This page shows all MCP clients for your organization, including clients created through the Kibana API using an Elastic Cloud API key. Those clients are not visible in the Agent Builder client list in Kibana — the organization-level view here is the only place to manage them.

To narrow the list, use the search box to filter by name, or use the Status filter.

If no project in your organization has any MCP client connections yet, the page shows an empty state. Open a Serverless project to begin. Connections appear here once users start authorizing MCP clients.

A connection has one of the following statuses:

  • Active — the connection is authorized. The session may have expired if unused for 30 or more days.
  • Expired — the connection's refresh window lapsed after 30 days of inactivity. The user must re-authorize to use it again.
  • Revoked — the connection was revoked and can no longer be used.

Revoked connections remain visible for 3 months and revoked clients for 1 year (use the status filter to show them). Expired connections remain visible until re-authorized or removed.

Select a client to open its details panel. The panel shows the connection details a user needs to configure an MCP host, for reference:

  • Client ID — the unique identifier for the MCP client.
  • MCP server URLs — the redirect URIs configured for this client (the callback URLs used during the OAuth consent flow).
  • A reminder that the client secret is required for confidential clients and is shown only once, when the client is created.

To create or edit a client, click Manage MCP client to open the project's Agent Builder client management in Kibana.

Revoking removes the selected connections only. The MCP client stays registered and can accept new connections, and an application can be reconnected at any time.

To revoke a single connection, click Revoke in its row.

To revoke several connections at once:

  1. Select the checkbox for each connection you want to revoke. In grouped view, use Select all connections for this client to select every connection under a client, or Clear selection to start over.
  2. Click Revoke N connections.
  3. Review the connections in the confirmation dialog, then click Revoke access.

You can revoke up to 100 connections at a time.

Tip

Removing a user from your identity provider does not automatically revoke that user's connections. When a user leaves, revoke their connections here to cut off access.

To revoke an entire MCP client and all its connections, the client's creator removes it from the project's Agent Builder client management in Kibana. See Revoke an MCP client or connection.