An MCP credential is not revoked when the control plane says “disabled.”
It is revoked when every path that could still accept it stops accepting it.
That includes:
- new client connections
- existing MCP sessions
- gateway policy caches
- refresh and exchanged tokens
- queued jobs
- background workers
- database connection pools
- downstream APIs
Define a revocation SLO from the authoritative change to the final protected operation.
Then run a drill:
- issue a uniquely tagged, narrowly scoped credential
- open fresh and persistent sessions
- queue a bounded job
- record the revocation timestamp
- retry through every supported path
- terminate downstream sessions as designed
- search for successful calls after the deadline
- restore access with a new credential
- prove the old one remains invalid
The most important timestamp is not when the dashboard acknowledged the change.
It is the last successful protected operation.
Full guide: MCP credentials: test revocation propagation before production
Top comments (0)