Remove an MCP server safely

A team decides to retire an MCP server, maybe it's unused, maybe it's being replaced. Someone deletes the config entry and the credential that authorized it. The change looks clean: tests pass, nothing visibly breaks on deploy. Weeks later, a scheduled job or a rarely-triggered agent path fails because it still referenced the server by name.

Config deletion and dependency removal are different things. A server can be referenced from a repository nobody thought to check, a cron job that only runs weekly, or a shared credential that another integration also authorizes against. Tests passing proves the code you touched still works; it doesn't prove nothing else in the organization depended on what you removed.

Wirecheck separates the question into three steps that match the actual risk: what currently depends on this, what changed after you made the edit, and whether removal is actually confirmed, not assumed. Zero known dependants is treated as a fact to report, not a green light, especially when one or more UNKNOWN relationships remain.

wirecheck preflight stripe-mcp --json

{
  "component": { "name": "stripe-mcp", "type": "MCP_SERVER", "confidence": "HIGH" },
  "direct_dependants": 3,
  "indirect_dependants": 1,
  "unknown_relationships": 1,
  "affected_repositories": ["acme/billing-agent", "acme/refund-workflow"],
  "evidence": [{ "file": "mcp.json", "line": 14, "detector": "mcp-config" }]
}

3 known dependants and 1 unresolved reference. That unresolved reference is a reason to look before removing anything, not a rounding error.

# update the known consumers, remove the config entry and credential

wirecheck compare acme/billing-agent --json

wirecheck verify retirement stripe-mcp --operation REMOVE --json

{ "status": "UNRESOLVED_REMAIN", "targetRemoved": true, "unknownConsumers": [{ "name": "legacy-sync.sh" }] }

status is one of REMOVAL_VERIFIED, UNRESOLVED_REMAIN, or CONSUMERS_REMAIN. Only the first one means the removal is actually confirmed clean.

Every known dependant and every unresolved reference above comes with a file and line, not just a name. “3 known dependants” is backed by three actual locations you can open, and retirement status comes from re-scanning the repository after the change, not from assuming the edit worked.

Wirecheck never returns a safe_to_remove field. A reference it can't classify stays UNKNOWN rather than being dropped or guessed at, and compare diffs two completed scans, it is not a live git-diff against an uncommitted working tree.