chore: revoke access tokens on server shutdown [MCP-53]

[fmenezes]

Proposed changes

revoke atlas access tokens on server shutdown [MCP-53]

Checklist

• I have signed the MongoDB CLA

[Copilot]

Pull Request Overview

Adds explicit revocation of Atlas access tokens during shutdown and cleans up duplicated shutdown calls.

• Introduce apiClient.close() to revoke tokens in ApiClient
• Invoke apiClient.close() in Session.close()
• Remove duplicate mcpServer.close() and adjust shutdown order in Server.close()

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/common/atlas/apiClient.ts	Added a close() method to revoke stored access tokens
src/session.ts	Called apiClient.close() after disconnect() in Session.close()
src/server.ts	Moved and deduplicated mcpServer.close() in Server.close()

Comments suppressed due to low confidence (2)

src/common/atlas/apiClient.ts:98

• The new close() method isn’t covered by tests yet. Adding unit tests to verify that accessToken.revokeAll() is called when an access token is present would help ensure correct behavior.

    public async close(): Promise<void> {

src/server.ts:104

• [nitpick] Closing the MCP server before the session could terminate active sessions prematurely. Consider invoking session.close() before mcpServer.close() or add a comment explaining the intended shutdown sequence.

        await this.mcpServer.close();

[himanshusinghs]

LGTM

[blva]

LGTM, but are atlas tests supposed to fail?

[coveralls]

Pull Request Test Coverage Report for Build 16199405806

Details

• 12 of 12 (100.0%) changed or added relevant lines in 3 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.06%) to 74.893%

---

Totals
Change from base Build 16194723276:	0.06%
Covered Lines:	871
Relevant Lines:	1073

---

💛 - Coveralls