MCP fixes and known issues in Cursor
If you are running into MCP problems with Cursor, this page documents the known issues and the releases that fixed them.
Known issues
No open MCP issues are tracked for Cursor right now.
OAuth discovery and callback handling
Cursor authenticates from more than one surface, and each surface has its own callback URL. Register the callback for every surface your users authenticate from. A user who starts on desktop and later runs a cloud agent otherwise fails on the second surface with no obvious cause.
| Surface | Callback URL | Status |
|---|---|---|
| Web and Cursor Agents | https://www.cursor.com/agents/mcp/oauth/callback | Documented |
| Desktop app | http://localhost:8787/callback | Documented |
| Desktop app, some installs | cursor://anysphere.cursor-mcp/oauth/callback | Community reported |
2.3 introduced static client headers carrying scopes and state. MintMCP publishes static client credentials alongside supporting dynamic client registration, which matters because enterprise IdPs frequently disable dynamic registration outright.
| Release | Change |
|---|---|
| CLI 2026-01-16 | One-click MCP authentication in the CLI with automatic callback handling, plus /mcp list for browsing, enabling, and configuring servers |
| 2.3 2025-12-22 | Added support for static client headers in MCP OAuth, with scopes and state, and OAuth servers open new auth tabs at startup for previously authenticated servers |
| 1.0 2025-06-04 | One-click MCP install with OAuth support for servers that support it |
Token lifecycle and credential storage
Large tokens are oversized OAuth access tokens: the long JWTs enterprise IdPs issue when they pack in many scopes or claims, which earlier Cursor builds could truncate or reject. 3.3 fixed transient 401 and stale-credential handling, 3.4 reworked the token lifecycle and large-token handling, and 3.7 resolved the remaining MCP OAuth reliability issues. Require 3.7 for dependable OAuth; on older builds, 3.4 is the floor for large-token and refresh-token handling, and 3.3 for stale-credential cleanup.
| Release | Change |
|---|---|
| 3.7 2026-06-17 | Resolved the remaining MCP OAuth reliability bugs; MCP OAuth connections are dependable from this release on |
| 3.4 2026-05-13 | Reworked MCP auth token lifecycle handling and fixed token edge cases: transient 401, stale-token, and large-token (oversized JWT) handling |
| 3.3 2026-05-07 | More predictable MCP connection behavior, with explicit stale token cleanup on re-auth |
| 3.3 2026-05-06 | Fixed MCP auth edge cases including transient 401 handling and stale credential behavior |
| CLI 2026-02-18 | When a server's credentials expire mid-session, the agent re-authenticates on demand instead of failing silently |
Scope, resource, and audience binding
2.3 introduced static client headers carrying scopes and state, so a server that needs specific scopes at authorize time works from 2.3 on.
Keep one canonical URL for your MCP endpoint and use it identically in the MCP URL, the protected resource metadata resource field, the authorize request, and the token audience. Cursor compares the protected resource value by exact string, including the trailing slash, and a mismatch fails token exchange.
Transport and connection reliability
Cursor supports three transports: stdio (local, single user), SSE (local or remote, multiple users), and Streamable HTTP (local or remote, multiple users). The envFile option applies only to stdio servers, so remote servers cannot take configuration that way. Cursor isolates server failures so one failing server does not affect the others.
| Release | Change |
|---|---|
| 2.6 2026-03-03 | More reliable MCP setup and configuration, and fixed configuration dialogs that could get stuck or behave inconsistently |
| 2.4 2026-01-22 | Fixed a performance problem when adding more MCP server connections |
| 1.6 2025-09-12 | Added MCP Resources support, added interpolated variables so environment variables can be used in server configuration strings, and fixed MCP server connection issues (1.6.9) |
| 1.1 2025-06-12 | Fixed an MCP performance regression |
| 0.48 2025-03-23 | MCP on Windows significantly more reliable, with improved error messages when configuring servers |
Tool discovery and tool catalogs
2.4 moved server definitions and tools into JSON files under .cursor, loaded only when an agent needs them, so a connected server does not mean every tool is in context.
Keep tool names short and ASCII, keep descriptions tight, and prefer a small scoped catalog per connection.
| Release | Change |
|---|---|
| 2.4 2026-01-22 | Server definitions and tools live as JSON files in .cursor, and agents discover and load them only when needed, reducing token usage |
Approvals, policy, and governance
Team MCP servers distribute a connection from one place, and leave the decision of who may call which tool to the client.
| Release | Change |
|---|---|
| 3.10 2026-06-30 | Admins configure Team MCP servers once and distribute them across cloud agents, the agents window, the IDE, and the CLI, and can publish them to a team marketplace for local install |
| 3.6 2026-05-29 | Auto-review applies to MCP tool calls: allowlisted calls run immediately, and the rest go to a classifier subagent that allows, redirects, or asks for approval |
| CLI 2026-02-18 | Skipping approval for a server keeps it disabled for the rest of the session rather than prompting repeatedly, and auto-run now applies to delete and MCP tools when toggling with Shift+Tab |
| 2.5 2026-02-17 | Plugins package MCP servers alongside skills, subagents, hooks, and rules into a single install |
| CLI 2026-01-16 | Added WebFetch and WebSearch tools with approval options for granular control over web requests from MCP tools |
Earlier approval and allowlist changes (February 2025 to January 2026)
| Release | Change |
|---|---|
| CLI 2026-01-08 | Added /mcp enable and /mcp disable, and support for server names containing spaces in all /mcp commands |
| 1.7.x 2025-09 | Added MCP autorun support (1.7.2), browser and MCP tools improvements (1.7.19), MCP allowlist updates (1.7.40), and fixed the MCP allowlist full wildcard (1.7.42) |
| 0.48 2025-03-23 | Projects with MCP servers prompt users to enable them |
| 0.46.2 2025-02-19 | Added the option to disable yolo mode for MCP |
Protocol features
| Release | Change |
|---|---|
| 3.0 2026-04-02 | MCP Apps support structured content, for richer tool outputs |
| 2.6 2026-03-03 | Added MCP Apps support |
| 1.5 2025-08-21 | Added MCP elicitation support, so servers can request structured input with JSON-schema-validated responses |
| 0.49 2025-04-15 | Images can be passed as context from MCP servers |