#MCP

Model Context Protocol (MCP) connects Cursor to external tools and data so you do not re-explain the project every time. Install from Customize, or write mcp.json. For protocol, transports, and security in depth, use this site’s MCP course; this chapter is Cursor-specific setup. Official page: cursor.com/docs/mcp.

#Why MCP inside Cursor

Without MCP you paste issues, designs, and schemas into chat. With MCP, Agent (including Plan Mode) can call those capabilities from Available Tools. Implement a server in any language that can print to stdout or serve HTTP.

Official plugins: Cursor Marketplace (one-click from Customize, often OAuth). Community catalog: cursor.directory. Enterprises can also ship servers from a team marketplace.

#Transports

Cursor also supports Tools, Prompts, Resources, Roots, Elicitation, and MCP Apps (interactive UI). If the host cannot render UI, the same tool still works via normal MCP responses.

#Where the config lives

The agent CLI shares these files. Discovery order (project → global → nested) matches the editor.

#mcp.json examples

stdio (Node):

{
  "mcpServers": {
    "server-name": {
      "command": "npx",
      "args": ["-y", "mcp-server"],
      "env": {
        "API_KEY": "${env:API_KEY}"
      }
    }
  }
}

stdio (Python):

{
  "mcpServers": {
    "server-name": {
      "command": "python",
      "args": ["${workspaceFolder}/tools/mcp_server.py"],
      "env": {
        "API_KEY": "${env:API_KEY}"
      }
    }
  }
}

Remote HTTP / SSE:

{
  "mcpServers": {
    "server-name": {
      "url": "http://localhost:3000/mcp",
      "headers": {
        "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
      }
    }
  }
}

Common stdio fields: type ("stdio"), command, args, env, envFile (e.g. "${workspaceFolder}/.env"). envFile is stdio-only; remote servers should use env interpolation.

For remote OAuth with a fixed Client ID, add auth on a url entry (CLIENT_ID, optional CLIENT_SECRET, scopes). Desktop callback: http://localhost:8787/callback. Web / Cloud Agents: https://www.cursor.com/agents/mcp/oauth/callback. Trust the official MCP page for the full table.

#Interpolation

Cursor resolves variables in command, args, env, url, and headers (auth too).

Do not hardcode secrets in JSON. Use ${env:NAME} and keep .env out of Git.

#Using and approving tools in chat

Agent picks MCP tools when they are relevant; you can also name a tool or describe the need. Toggle servers in Customize. Approval is on by default—expand the tool name to see arguments.

MCP follows the same Run Modes as the terminal. In Auto-review, allowlisted tools run immediately and the rest go through the classifier. See Run Modes.

Debug:

1. Open the Output panel (Ctrl+Shift+U / Cmd+Shift+U)
2. Choose MCP Logs
3. Inspect connect, auth, and crash lines

One crashed server does not take the others down.

CLI:

agent mcp list
agent mcp list-tools playwright
agent mcp login <identifier>

#Security (read before you install)

Official habits:

• Install from trusted authors and repos
• Review which data and APIs the server can reach
• Use least-privilege API keys
• Audit source for critical integrations

MCP can call external services and run logic on your machine. Prefer stdio + env vars for sensitive data; never commit tokens. Enterprise admins can set allowlists, network sandboxes, and a team marketplace—follow the Dashboard.

For protocol-level threat models, auth, and writing a client, read this site’s MCP course. “It connected” is not the end of the lesson.

#Minimum verification

1. Add a server in Customize or mcp.json.
2. Confirm it appears under Available Tools.
3. Tell Agent: Use the <server> tools to … (real capability).
4. Expand the tool call and check that arguments have no surprise paths or secrets.

#Next

• Models
• Practical Examples
• This site’s MCP course