---
title: Manage MCP client connections
description: Audit and revoke MCP client connections across an Elastic Cloud organization's serverless projects from a single organization-level view.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/users-roles/cloud-organization/manage-mcp-client-connections
products:
  - Elastic Cloud Serverless
applies_to:
  - Elastic Cloud Serverless: Preview
---

# Manage MCP client connections
The **Application connections** page in the Elastic Cloud Console gives organization administrators a single place to audit and revoke [MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-oauth) connections that members of your organization have authorized across their Serverless projects.
<note>
  During technical preview, application connections cover **MCP clients only**, and connected applications get **read-only** access through Elasticsearch Query Language (ES|QL)-based tools. Support is limited to Serverless projects.
</note>

To create an MCP client or connect an MCP host such as **Claude Desktop**, see [Connect an MCP host to an MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-connect) in the Agent Builder documentation. This page covers organization-level management only.

## Before you begin

To access this page, open **Organization → Security settings → Application connections** in the Elastic Cloud Console. What you can see and revoke depends on your role:
- **Organization owners** see every application connection in the organization.
- **Other users** see connections for the projects they administer, plus any connections they authorized themselves.

The page offers two views, toggled by the **Group by client** and **List view** buttons:
- **Group by client** (default for organization owners) — lists each MCP client with a count of its connections. Expand a client row to see individual connections.
- **List view** — shows all connections in a flat, sortable table.


## View application connections

The **Application connections** page shows each MCP client and its connections. In grouped view, expand a client to see its individual connections. Each connection row shows the following details:

| Column             | Description                                                                           |
|--------------------|---------------------------------------------------------------------------------------|
| Connection name    | The name of the connection, derived from the MCP client name.                         |
| Authorization date | When the user authorized the connection.                                              |
| Connected by       | The email address of the user who authorized the connection.                          |
| Status             | The current state of the connection. See [Connection statuses](#connection-statuses). |

<note>
  This page shows all MCP clients for your organization, including clients created through the Kibana API using an Elastic Cloud API key. Those clients are not visible in the Agent Builder client list in Kibana — the organization-level view here is the only place to manage them.
</note>

To narrow the list, use the search box to filter by name, or use the **Status** filter.
If no project in your organization has any MCP client connections yet, the page shows an empty state. Open a Serverless project to begin. Connections appear here once users start authorizing MCP clients.

### Connection statuses

A connection has one of the following statuses:
- **Active** — the connection is authorized. The session may have expired if unused for 30 or more days.
- **Expired** — the connection's refresh window lapsed after 30 days of inactivity. The user must re-authorize to use it again.
- **Revoked** — the connection was revoked and can no longer be used.

Revoked connections remain visible for 3 months and revoked clients for 1 year (use the status filter to show them). Expired connections remain visible until re-authorized or removed.

## View MCP client details

Select a client to open its details panel. The panel shows the connection details a user needs to configure an MCP host, for reference:
- **Client ID** — the unique identifier for the MCP client.
- **MCP server URLs** — the redirect URIs configured for this client (the callback URLs used during the OAuth consent flow).
- A reminder that the **client secret** is required for confidential clients and is shown only once, when the client is created.

To create or edit a client, click **Manage MCP client** to open the project's Agent Builder client management in Kibana.

## Revoke connections

Revoking removes the selected connections only. The MCP client stays registered and can accept new connections, and an application can be reconnected at any time.
To revoke a single connection, click **Revoke** in its row.
To revoke several connections at once:
1. Select the checkbox for each connection you want to revoke. In grouped view, use **Select all connections for this client** to select every connection under a client, or **Clear selection** to start over.
2. Click **Revoke *N* connections**.
3. Review the connections in the confirmation dialog, then click **Revoke access**.

You can revoke up to 100 connections at a time.
<tip>
  Removing a user from your identity provider does **not** automatically revoke that user's connections. When a user leaves, revoke their connections here to cut off access.
</tip>

To revoke an entire MCP client and all its connections, the client's creator removes it from the project's Agent Builder client management in Kibana. See [Revoke an MCP client or connection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-revoke).

## Next steps

- To restore access after revoking a client, [create a new MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-create) and distribute the credentials to users.


## Related pages

- [Create an MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-create) (Agent Builder)
- [Connect an MCP host to an MCP client](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-connect) (Agent Builder)
- [Revoke an MCP client or connection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-revoke) (Agent Builder)
- [Authenticate MCP clients with OAuth](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-client-oauth)