Uninstall the Enterprise DLP MCP Server

Table of Contents

Recommendations for Security Policy Rules

Uninstall the Enterprise DLP MCP Server

Remove the MCP server from your AI agent, uninstall the npm package, and revoke the service account's access to Enterprise DLP.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Panorama or Strata Cloud Manager) Prisma Access (Managed by Panorama or Strata Cloud Manager) SaaS Security Inline Data Security Prisma AIRS Prisma Browser Email DLP Endpoint DLP	Enterprise Data Loss Prevention (E-DLP) license, or one of the following licenses that include it: Prisma Access CASB license Next-Generation CASB for Prisma Access and NGFW (CASB-X) license Data Security license An AI agent and AI model that support the Model Context Protocol (MCP) Node.js 18 or later installed on the machine that runs your AI agent A service account with a role that grants view access to Enterprise DLP
Use the MCP server to view your Enterprise DLP configurations and data regardless of the enforcement point where they are applied.

Where Can I Use This?

What Do I Need?

NGFW (Managed by Panorama or Strata Cloud Manager)
Prisma Access (Managed by Panorama or Strata Cloud Manager)
SaaS Security Inline
Data Security
Prisma AIRS
Prisma Browser
Email DLP
Endpoint DLP

Enterprise Data Loss Prevention (E-DLP) license, or one of the following licenses that include it:
- Prisma Access CASB license
- Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
- Data Security license
An AI agent and AI model that support the Model Context Protocol (MCP)
Node.js 18 or later installed on the machine that runs your AI agent
A service account with a role that grants view access to Enterprise DLP

Use the MCP server to view your Enterprise DLP configurations and data regardless of the enforcement point where they are applied.

Uninstall the Enterprise Data Loss Prevention (E-DLP) MCP server when you retire the integration, rotate access, or move to a different AI agent. Removing the server from your agent stops the agent from calling your Enterprise DLP tenant, and deleting the service account revokes the credentials so that nothing else can use them.

Remove the paloaltonetworks-dlp MCP server from your AI agent's configuration.

Delete the paloaltonetworks-dlp entry from the MCP configuration file for your agent. This is the file you edited when you set up the MCP server manually. If you set up the MCP server using a prompt, you can ask your agent to remove it.
Restart your AI agent so that it stops loading the MCP server.
(Optional) Uninstall the MCP server package.
If you installed the package globally, run the following command in any terminal, such as Command Prompt or PowerShell on Windows, or Terminal on macOS and Linux:
```
npm uninstall -g @paloaltonetworks/mcp-dlp
```
If your agent ran the MCP server only through npx, skip this step.
Remove the service account credentials from your environment.

If you set the DLP_CLIENT_ID, DLP_CLIENT_SECRET, DLP_TSG_ID, or DLP_READ_ONLY environment variables, remove them from your shell profile or your system environment variables.
Delete the Strata Cloud Manager service account that you created for your AI agent.

Log in to Strata Cloud Manager and select System SettingsIdentity & AccessAccess Management. Find the service account you created for your AI agent and delete it. Deleting the account revokes the agent's access to your Enterprise DLP tenant.

Files that your agent saved on your machine, such as a tenant configuration snapshot, remain until you delete them.

Enterprise DLP MCP Server Skills

Recommendations for Security Policy Rules

Enterprise DLP Docs

Uninstall the Enterprise DLP MCP Server

Enterprise DLP Docs

Uninstall the Enterprise DLP MCP Server

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner