feat(THU-618): support editing MCP servers in settings

[raivieiraadriano92]

Adds an Edit action to the MCP servers settings page so users can update an existing server's config (name, URL, headers, credentials) without deleting and re-adding it.

• New updateMcpServer DAL helper + tests.
• useAddServerForm reused for both add and edit; the dialog opens prefilled when editing.

Fixes THU-618.

---

Note

Medium Risk
Touches MCP connection lifecycle (reconnect, in-flight connect coalescing, credential writes) and local secret handling; well-covered by new tests but mis-sync could leave stale clients or wrong auth.

Overview
Users can edit existing MCP servers from settings (pencil on each card) instead of delete-and-re-add. The shared add dialog runs in Edit mode with prefilled name, URL, transport, and bearer token; JSON bulk-import is hidden while editing.

Persistence: New DAL helpers updateMcpServer / updateMcpServerWithCredentials patch server rows and optionally replace, delete, or leave mcp_secrets credentials unchanged (so OAuth tokens aren’t wiped on rename-only saves).

Save UX: useAddServerForm tracks hasConnectionEdits so metadata-only changes (e.g. rename) can save without a new successful probe; renames no longer clear a passing test result. Connection field changes still require test success before save.

Live connections: updateServerStatus is replaced by updateServer, which patches in-memory config and reconnects when enabled (URL/transport/credential changes). Settings calls it with forceRedial after save so credential-only updates apply even if an initial connect is still in flight. useMcpSync now diffs name/url/type/enabled and calls updateServer, not just enable toggles.

^{Reviewed by Cursor Bugbot for commit 437a5db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Semgrep Security Scan

No security issues found.

[github-actions]

Preview environment destroyed 🧹

Stack preview-pr-1008 and its Cloudflare subdomain have been cleaned up.

[github-actions]

PR Metrics

Metric	Value
Lines changed (prod code)	+479 / -112
JS bundle size (gzipped)	🟢 783.6 KB → 630.4 KB (-153.2 KB, -19.6%)
Test coverage	🟢 77.27% → 77.35% (+0.1%)
Performance (preview)	Preview not ready — Render deploy may have timed out
Accessibility	—
Best Practices	—
SEO	—

Updated Wed, 08 Jul 2026 11:33:03 GMT · run #2235

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 437a5db. Configure here.}

[github-actions]

🔭 thunder-deep-review (advisory)

Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
_{head: df0a6dda88da · mode: deep · deferred 7 item(s) already reported by other bots (best-effort dedup)}

[github-actions]

🔭 thunder-deep-review (advisory)

Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
_{head: f15675233d52 · mode: deep · deferred 7 item(s) already reported by other bots (best-effort dedup)}

[github-actions]

🔭 thunder-deep-review (advisory)

Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
_{head: a9d67b4b54aa · mode: deep · deferred 7 item(s) already reported by other bots (best-effort dedup)}

[github-actions]

🔧 Nit — Save-eligibility logic is duplicated (and inverted) across the button and the Enter handler

The rule for "is this edit saveable?" now lives in two places written in opposite polarity: the Save button's disabled expression here (enabled when hasConnectionEdits is false OR isClearingBearerOnly OR isOAuthEdit OR testResult is success), and the Enter branch in handleUrlKeyDown at line 535 (!form.hasConnectionEdits || form.isClearingBearerOnly || form.isOAuthEdit, notably missing the success case, which then relies on a separate branch below). Keeping two hand-inverted copies of the same gate in sync is exactly the kind of thing that drifts — the missing success arm in the keydown path is a symptom. Could we hoist a single derived const canSaveEdit = ... and have both the button and Enter read it? That collapses the logic to one source of truth and makes the intent obvious.

[github-actions]

🔭 thunder-deep-review (advisory)

Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
_{head: 1f1cf2a16ce8 · mode: deep · deferred 7 item(s) already reported by other bots (best-effort dedup)}

Additional notes (couldn't anchor to a diff line)

• src/hooks/use-add-server-form.ts — 🚫 Blocking — Blurring the URL field on an OAuth edit bypasses the OAuth-skip guard