MCP in Cursor: mcp.json, OAuth and keys

The short version: Cursor reads MCP servers from ~/.cursor/mcp.json (all projects) and .cursor/mcp.json (one project). A remote server needs nothing but a url field, and Cursor will offer to sign in over OAuth. If a browser sign-in is awkward, a key goes into headers through an environment variable.

Two files, two scopes

You can open the list of servers in Cursor's settings, in the MCP section: it shows which servers are connected, how many tools each has, and a toggle to switch a server off for a while. If you are still getting to know the protocol, start with the overview of MCP servers.

Path 1. A URL and OAuth sign-in

The shortest route is to write down the addresses only. Tick the tools below and a ready mcp.json assembles itself.

{
  "mcpServers": {
    "twelver-image-generation": {
      "url": "https://twelver.ru/api/mcp/v1/image-generation"
    },
    "twelver-web-search": {
      "url": "https://twelver.ru/api/mcp/v1/web-search"
    }
  }
}

Save the file and a sign-in button appears next to the server in settings. Click it, sign in to your Twelver account in the browser, and the server goes active. OAuth needs a registered account.

Path 2. A key in a header

On shared machines, in containers, and whenever the browser sign-in will not go through, a key is easier. Get one with the button below, no registration:

export TWELVER_API_KEY="sk-<your-key>"

Then refer to the variable from mcp.json — Cursor expands it at launch, and the key never reaches the repository:

{
  "mcpServers": {
    "twelver-web-search": {
      "url": "https://twelver.app/api/mcp/v1/web-search",
      "headers": {
        "Authorization": "Bearer ${env:TWELVER_API_KEY}"
      }
    },
    "twelver-image": {
      "url": "https://twelver.app/api/mcp/v1/image-generation",
      "headers": {
        "Authorization": "Bearer ${env:TWELVER_API_KEY}"
      }
    }
  }
}

Cursor on macOS, launched from the Dock, may not see variables from ~/.zshrc. If the server answers 401, start Cursor from the terminal with cursor . so it inherits the shell environment.

Call approval

By default Cursor asks for permission before every MCP tool call and shows you the parameters. That is sensible for tools that change something or spend your balance. For search and page reading you can drop the prompt by adding the tool to the auto-run allowlist — the agent then works without pauses.

What to ask the agent for

• "Read the current docs on migrating to the new version of the library and draft a plan of edits" — web-search and web-crawl instead of an answer from the model's stale memory.
• "Generate three hero images for the landing page at 16:9 and put the first one into the markup" — text-to-image returns links to the files. More on generation in image and video generation over MCP.

If it does not work

Wiring the same thing up in other clients? Instructions for Claude and LM Studio. The server builder page for Cursor is Twelver MCP servers for Cursor.