The dbcrypt CLI iterated user_links, external_auth_links, user_secrets,
ai_providers, ai_provider_keys, and user_ai_provider_keys, but not the
three MCP tables that the interceptor encrypts: mcp_server_configs,
mcp_server_user_tokens, and mcp_server_user_header_values. After
`server dbcrypt rotate` or `decrypt` revoked the prior cipher, MCP rows
still referenced the revoked digest and became unreadable.
Add per-row updates that re-encrypt or clear the MCP secrets before the
old keys are revoked, and extend the destructive `delete` SQL to clear
the three tables. A new UpdateEncryptedMCPServerConfig query plus its
dbcrypt wrapper move the three mcp_server_configs columns (and their
key_id pointers) atomically.
Extend TestServerDBCrypt to seed an MCP server config plus the per-user
token and header rows for each user, and assert that every rotate /
decrypt / delete step touches them correctly.
Steven Masley
12407c0c6b