[saddlepaddle]

Part of the MCP v2 rework (Phase E1). Stacked on #6076 — retargets to main when that merges.

Removes:

• packages/mcp (the 18-tool v1 server)
• apps/api/src/app/api/agent/[transport]/ route + its parallel 274-line auth-flow.ts (incl. the v1-only session-cookie auth path)
• @superset/mcp workspace dep
• the v1 audience entry from validAudiences
• v1 "still available" language from docs and openapi.json

Adds a terse 410 Gone handler at /api/agent/* with a hint pointing at /api/v2/agent/mcp.

Known remaining v1 traffic (Vercel logs, 2026-07-31): MCP handshake triplets + SSE GETs matching desktop builds that predate #6031's chat change. Impact of the 410: chat tool-loading try/catches and returns empty — old desktops lose Superset tools in chat until they update, no crash. Side benefit: v1's hanging SSE GETs were each burning an 800s function invocation (visible as 504s); the 410 ends that.

Follow-up (separate ticket): with v1 gone, nothing writes agentCommands — evaluate removing the table, its tRPC router, and the desktop useCommandWatcher chain.

Verify post-deploy: curl -X POST https://api.superset.sh/api/agent/mcp → 410 with hint; v2 endpoint unaffected; Slack agent smoke.

https://claude.ai/code/session_01Kub4p3Eim9pc1qaRRmGea2

---

---

Summary by cubic

Removes the v1 MCP server and package, and returns 410 Gone for all /api/agent/* requests with a hint to /api/v2/agent/mcp. This simplifies the API and stops long-running v1 SSE invocations; v2 remains unchanged.

• Refactors

  • Removed packages/mcp (18 tools) and the @superset/mcp dependency.
  • Deleted /api/agent/[transport] route and auth-flow.ts; added a 410 Gone handler for GET/POST/DELETE.
  • Dropped the v1 audience from validAudiences.
  • Updated docs and OpenAPI to state v1 is removed.
  • Cleaned up bun.lock.

• Migration

  • Point clients to /api/v2/agent/mcp. v1 URLs now return 410 with a redirect hint.
  • Older desktop builds degrade by losing Superset tools in chat until updated (no crashes).
  • Smoke check: POST to /api/agent/mcp → 410; v2 endpoint and Slack agent remain OK.

^{Written for commit 3c570f6. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ba773b25-010a-4388-a95a-4eb624628912

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ghost]

Ready to review this PR? Stage has broken it down into 5 individual chapters for you:

	Title
1	Remove the v1 MCP server package
2	Clean up authentication and dependencies
3	Replace v1 routes with 410 Gone
4	Update documentation and OpenAPI spec
5	Other changes

_{Chapters generated by Stage for commit 3c570f6 on Jul 31, 2026 9:10pm UTC.}

[github-actions]

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

• ✅ Neon database branch

Thank you for your contribution! 🎉