feat(mcp-servers): add DELETE endpoint to permanently remove a connector

[kristopolous]

Summary

Fixes #494.

There is currently no way to permanently remove a configured MCP connector:

• Header-auth connectors (Bright Data, GitHub, Tavily, custom "Add MCP Server" entries) have no removal option at all — only "Replace Key".
• OAuth (dcr) connectors' "Disconnect" only clears the stored token (DELETE /{name}/authorize); the row stays in "Configured" with an auth_required badge forever.

This PR adds the missing backend piece: DELETE /api/v1/settings/mcp-servers/{name}.

• IMcpServerStore.deleteServer implemented for both Postgres and SQLite (DELETE FROM mcp_server WHERE tenant_id = ? AND name = ?).
• OAuth tokens and pending authorizations cascade-delete automatically via the existing oauth_server_id foreign key (ON DELETE CASCADE, already in place from the DCR migrations) — no extra cleanup code needed.
• Route + handler follow the exact same pattern as the existing deleteAgentRoute/deleteAgentHandler: idempotent, 200 with {} on success.

Scope: backend only

packages/trueforge-sdk is Fern-generated in CI (.github/workflows/generate-sdk.yaml), and that workflow explicitly cannot push its regen commit to a fork PR's branch — it only runs after merge to main (or same-repo PRs). I actually ran the generator locally to check: it produced a 447-file, ~15k-line diff that's almost entirely unrelated generator-version churn (e.g. import type X → import X, modifier reordering) that has nothing to do with this endpoint — not something that belongs in this PR, and AGENTS.md forbids hand-editing packages/trueforge-sdk besides.

So this PR is the backend endpoint only, fully implemented and tested. The Connect UI's "Remove" button is a fast-follow PR once this merges and the SDK regenerates on main (either automatically via the same workflow, or a maintainer running pnpm sdk:generate).

API docs: no manual doc changes needed — Mintlify's API reference (docs/docs.json) reads directly from docs/openapi.json, which regenerates alongside the SDK and will pick up the new endpoint automatically.

Test plan

• New tests in mcpServerStoreContractSuite.ts (runs against both backends): delete removes the row and cascades the OAuth client; idempotent for an unknown server, other tenants untouched.
• pnpm test:store:sqlite — 133 passed (was 131), 1 skipped.
• New tests in tests/unit/apis/mcpServers.test.ts: DELETE /{name} removes the server and cascades a saved token; idempotent for an unknown server.
• pnpm test (trueforge unit suite) — 294/294 pass.
• pnpm run typecheck — clean.
• pnpm eslint on changed files — clean.
• Added a changeset (@truefoundry/trueforge minor — new endpoint).
• Postgres store contract suite (pnpm test:store:postgres) — implementation is a verbatim mirror of the SQLite one using the same Kysely pattern already used for every other method in that file; couldn't verify locally (this sandbox blocks raw TCP to a local Postgres container), but CI runs it with a real postgres:17-alpine service against this exact test file.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MxyEPwQ73B27NTr83U69Ba

---

Note

Medium Risk
Permanently deletes connector rows and cascades OAuth tokens/authorizations; impact is limited to the admin settings API with existing auth gates and tests.

Overview
Adds DELETE /api/v1/settings/mcp-servers/{name} so admins can fully remove a configured MCP connector instead of only disconnecting OAuth (which left DCR servers in settings forever).

The settings router calls new IMcpServerStore.deleteServer on Postgres and SQLite (delete by tenant_id + name). Stored OAuth tokens and pending authorizations are dropped via existing ON DELETE CASCADE on oauth_server_id—no extra cleanup in the handler. The endpoint is idempotent: 200 with {} whether or not the server existed, matching other admin delete routes.

OpenAPI/Fern metadata and DeleteMcpServerResponseSchema are included; store contract and API unit tests cover cascade behavior and idempotency. Minor @truefoundry/trueforge changeset; SDK/UI follow separately.

^{Reviewed by Cursor Bugbot for commit b80860a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: b80860a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR