Join the waitlist→

///// AI hosts

MCP sign-in for Cursor

How Cursor signs in to a remote MCP server, the callback it registers, and how to check your server is ready for it.

The callback it registers

cursor://anysphere.cursor-mcp/oauth/callback

A custom-scheme callback that opens the desktop app. Your authorization server must allow non-HTTPS schemes for it.

Check your server for it

The anonymous check is the same for every host: it follows the sign-in chain from outside.

On your own server, --register also registers one client per host callback, including this one, and lists each client it created so you can delete them.

The MCP sign-in chain, step by step

The sign-in chain every host follows
AI host
/mcpyour server
  1. 401 challengeWWW-Authenticate: resource_metadata
  2. Protected-resource metadata/.well-known/oauth-protected-resource
  3. Authorization-server metadata/.well-known/oauth-authorization-server
  4. PKCEcode_challenge_methods_supported: S256
  5. Client registrationregistration_endpoint

The host stops here, and nothing looks wrong on your side.