Revoke a token
Revoke it under Settings › Agents. The assistant holding it is refused on its very next call, as is any download link it had asked for. An expired token stops the same way.
Disabling an account refuses its tokens at once; enabling it brings them back.
To let the assistant in again, make a new token. The old one stays in the list as revoked, with its activity.
Activity
Settings › Agents › Activity shows a token's last 100 calls, newest first: when, which tool, the arguments (ids and filters, never a picture), the outcome and how long it took. Refusals are there too. Rows are kept 90 days.
Turning agents off
DMS_MCP=off in the settings file, ~/.config/diune-media-server/env, leaves the agents' endpoint out altogether. By default it is on, and answers nothing until a token exists.