Cursor MCP Setup: Connect MCP Servers to Cursor IDE for AI Coding
TL;DR — Cursor MCP setup: configure servers in Settings > MCP, use Agent mode for AI tool calls. Cursor Docs: "Cursor supports MCP servers via Settings > Cursor Settings > MCP. stdio and SSE transports." TrueFoundry: "Cursor emerged as go-to MCP client. MCP donated to Linux Foundation December 2025 — vendor-neutral standard. Cursor Agent > MCP Client > MCP Server > External Tool." NxCode: "Over 5,000 community-built servers as of March 2026. Whatever tool you use, there is probably an MCP server for it." Bannerbear: "Manage GitHub issues, generate code from Figma, connect through Zapier — natural language within Cursor." Natoma: "Three setup options: local stdio for development, remote SSE for production, enterprise for governance." Learn more with MCP guide, build MCP server, Claude Desktop MCP, and MCP transports.
TrueFoundry provides context: "Cursor has emerged as one of the go-to MCP clients. In December 2025, Anthropic donated the whole thing to the Agentic AI Foundation (under the Linux Foundation), co-founded with Block and OpenAI. That move was significant. MCP went from being Anthropic's project to a genuinely vendor-neutral standard."
NxCode describes the ecosystem: "As of March 2026, the MCP ecosystem has grown to over 5,000 community-built servers. Whatever tool or service you use, there is probably an MCP server for it already."
Cursor MCP Architecture
Agent Mode"] Agent["Cursor Agent (AI)
decides which tools to call
based on user query"] Approval["Tool Approval
user approves each
tool call before execution"] MCPClient["MCP Client
built into Cursor
manages server connections"] end subgraph Config["Configuration"] Settings["Settings > Cursor Settings
> MCP"] McpJson["mcp.json
server definitions
command, args, env"] Transport{"Transport Type"} Stdio["stdio
local subprocess
no network"] SSE["SSE
remote server
network-dependent"] end subgraph Servers["MCP Servers"] FS["Filesystem
file read/write
restricted directories"] GitHub["GitHub
repos, issues, PRs
PAT authentication"] Context7["Context7
up-to-date library docs
version-aware"] Firecrawl["Firecrawl
web scraping
crawl, search, extract"] Postgres["Postgres
SQL queries
read-only access"] Brave["Brave Search
web search
API key"] end subgraph External["External Tools"] Files["Local Files"] GitRepos["GitHub Repos"] Docs["Library Docs"] Web["Web Pages"] DB["Database"] end Chat --> Agent Agent --> Approval Approval --> MCPClient Settings --> McpJson McpJson --> Transport Transport -->|local| Stdio Transport -->|remote| SSE Stdio --> FS Stdio --> GitHub Stdio --> Context7 Stdio --> Firecrawl Stdio --> Postgres SSE --> Brave MCPClient --> FS MCPClient --> GitHub MCPClient --> Context7 MCPClient --> Firecrawl MCPClient --> Postgres MCPClient --> Brave FS --> Files GitHub --> GitRepos Context7 --> Docs Firecrawl --> Web Postgres --> DB Brave --> Web
Transport Comparison
| Transport | Use Case | Connection | Clients | Best For |
|---|---|---|---|---|
| stdio | Local development | Subprocess stdin/stdout | Single | Filesystem, local DB, local tools |
| SSE | Remote/production | HTTP + Server-Sent Events | Many | Hosted APIs, cloud services, shared servers |
Popular MCP Servers for Cursor
| Server | Package | Transport | Use Case | Env Vars |
|---|---|---|---|---|
| Filesystem | @modelcontextprotocol/server-filesystem |
stdio | File read/write | None |
| GitHub | ghcr.io/github/github-mcp-server |
stdio (Docker) | Repos, issues, PRs | GITHUB_PERSONAL_ACCESS_TOKEN |
| Context7 | @upstash/context7-mcp |
stdio | Library docs | None |
| Firecrawl | @modelcontextprotocol/server-firecrawl |
stdio | Web scraping | FIRECRAWL_API_KEY |
| Postgres | @modelcontextprotocol/server-postgres |
stdio | SQL queries | None (conn string in args) |
| Brave Search | @modelcontextprotocol/server-brave-search |
stdio | Web search | BRAVE_API_KEY |
Implementation
from dataclasses import dataclass
from typing import Optional
from enum import Enum
class CursorTransport(Enum):
STDIO = "stdio"
SSE = "sse"
@dataclass
class CursorMCPSetup:
"""Cursor IDE MCP setup guide and configuration."""
def get_setup_steps(self) -> dict:
"""Steps to set up MCP in Cursor."""
return {
"steps": [
{
"step": 1,
"action": "Open Settings",
"detail": (
"Settings > Cursor Settings > MCP"
),
},
{
"step": 2,
"action": "Add New MCP Server",
"detail": (
"Click 'Add New MCP Server' button"
),
},
{
"step": 3,
"action": "Enter server name",
"detail": (
"Give your server a name "
"(e.g., 'filesystem', 'github')"
),
},
{
"step": 4,
"action": "Select transport type",
"detail": (
"Choose stdio (local) or "
"sse (remote)"
),
},
{
"step": 5,
"action": "Enter command/URL",
"detail": (
"stdio: command and args. "
"sse: server URL."
),
},
{
"step": 6,
"action": "Add environment variables",
"detail": (
"Add API keys, tokens as "
"env vars if needed"
),
},
{
"step": 7,
"action": "Click Add",
"detail": (
"Server is added to mcp.json. "
"Cursor connects to server."
),
},
{
"step": 8,
"action": "Verify in Agent mode",
"detail": (
"Open Agent mode in chat. "
"Server tools should appear. "
"Try using a tool in conversation."
),
},
],
}
def get_stdio_config(self) -> str:
"""stdio MCP server config for Cursor."""
return (
'{\n'
' "mcpServers": {\n'
' "filesystem": {\n'
' "command": "npx",\n'
' "args": [\n'
' "-y",\n'
' "@modelcontextprotocol/'
'server-filesystem",\n'
' "/Users/username/Projects"\n'
' ]\n'
' },\n'
' "github": {\n'
' "command": "docker",\n'
' "args": [\n'
' "run", "-i", "--rm",\n'
' "-e",\n'
' "GITHUB_PERSONAL_ACCESS_TOKEN",\n'
' "ghcr.io/github/'
'github-mcp-server"\n'
' ],\n'
' "env": {\n'
' "GITHUB_PERSONAL_ACCESS_TOKEN":\n'
' "ghp_your_token"\n'
' }\n'
' },\n'
' "context7": {\n'
' "command": "npx",\n'
' "args": [\n'
' "-y",\n'
' "@upstash/context7-mcp"\n'
' ]\n'
' }\n'
' }\n'
'}'
)
def get_sse_config(self) -> str:
"""SSE MCP server config for Cursor."""
return (
'{\n'
' "mcpServers": {\n'
' "remote-api": {\n'
' "url": "https://api.example.com"\n'
' "/mcp/sse"\n'
' }\n'
' }\n'
'}\n'
'\n'
'# SSE transport connects to\n'
'# remote MCP server via HTTP.\n'
'# Server must support SSE\n'
'# (Server-Sent Events).\n'
'# Best for production and\n'
'# shared team servers.'
)
def get_agent_mode_usage(self) -> dict:
"""How Cursor Agent mode uses MCP tools."""
return {
"flow": [
"User types query in Cursor chat "
"(Agent mode)",
"Agent receives available MCP tools "
"from connected servers",
"Agent decides which tools to call "
"based on user query",
"User approves tool execution "
"(Cursor asks for approval)",
"Agent calls tool via MCP protocol",
"Tool result fed back to agent",
"Agent generates response using "
"tool output",
"User can see which tools were called "
"and review each call",
],
"approval": (
"Cursor asks for user approval "
"before each tool call. User can "
"approve or deny. This is a "
"security boundary."
),
"discovery": (
"Agent discovers tools through "
"MCP list calls: tools/list, "
"resources/list, prompts/list. "
"No manual tool registration needed."
),
}
def get_security(self) -> dict:
"""Security considerations for Cursor MCP."""
return {
"principles": [
"Review what each MCP server can "
"access before enabling",
"Cursor asks for user approval "
"before each tool call",
"Use least-privilege API keys "
"and tokens",
"Audit which tools are called in "
"conversation history",
"Keep MCP server packages updated",
"Use env vars for secrets, never "
"hardcode in config",
],
"server_specific": {
"filesystem": (
"Restrict to specific directories. "
"Do not expose entire filesystem."
),
"github": (
"Use read-only tokens when possible. "
"Scopes: repo, read:org. "
"Use fine-grained PATs."
),
"postgres": (
"Use read-only connections for "
"queries. Create dedicated "
"database user with SELECT only."
),
"firecrawl": (
"Rate limit web scraping. "
"Respect robots.txt. "
"Use API key with scoped access."
),
},
"governance": (
"For enterprise: use governed "
"platform between AI and enterprise "
"systems. Single secure connection "
"to all applications, databases, "
"and tools."
),
}
def get_troubleshooting(self) -> dict:
"""Troubleshooting Cursor MCP issues."""
return {
"server_not_connecting": {
"causes": [
"Invalid command or args in config",
"Missing env vars or API keys",
"npx or docker not in PATH",
"Network issues for SSE servers",
"Server package not installed",
],
"fixes": [
"Verify command and args are correct",
"Check env vars are set properly",
"Use full path to npx/docker",
"Test server connection independently",
"Run npx -y @package manually to verify",
],
},
"tools_not_appearing": {
"causes": [
"Server not started successfully",
"Server has no tools registered",
"Agent mode not enabled",
],
"fixes": [
"Check Cursor MCP settings for "
"server status",
"Restart Cursor after adding server",
"Enable Agent mode in chat",
"Verify server exposes tools via "
"tools/list",
],
},
"tool_calls_failing": {
"causes": [
"API key invalid or expired",
"Network connectivity issues",
"Server process crashed",
"Permission denied on filesystem",
],
"fixes": [
"Regenerate API keys and update config",
"Check network for remote servers",
"Restart Cursor to restart server process",
"Verify filesystem paths exist and "
"are accessible",
],
},
}
Cursor MCP Checklist
- [ ] Open Settings > Cursor Settings > MCP to manage MCP servers
- [ ] Click Add New MCP Server to add a server
- [ ] Enter server name (e.g., filesystem, github, context7)
- [ ] Select transport type: stdio (local) or sse (remote)
- [ ] stdio: enter command and args (e.g., npx -y @modelcontextprotocol/server-filesystem)
- [ ] SSE: enter server URL (e.g., https://api.example.com/mcp/sse)
- [ ] Add environment variables for API keys and tokens
- [ ] Click Add to save server to mcp.json
- [ ] Cursor connects to server on save
- [ ] Verify tools appear in Agent mode
- [ ] MCP ecosystem has over 5,000 community-built servers as of March 2026
- [ ] MCP donated to Linux Foundation in December 2025 — vendor-neutral standard
- [ ] Cursor Agent (AI) > MCP Client (built into Cursor) > MCP Server (external process) > External Tool
- [ ] Agent mode: AI discovers tools via MCP list calls and invokes based on user query
- [ ] Cursor asks for user approval before each tool call — security boundary
- [ ] User can see which tools were called and review each call
- [ ] Filesystem server: npx -y @modelcontextprotocol/server-filesystem /path/to/dir
- [ ] GitHub server: docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server
- [ ] Context7 server: npx -y @upstash/context7-mcp for up-to-date library docs
- [ ] Firecrawl server: npx -y @modelcontextprotocol/server-firecrawl with FIRECRAWL_API_KEY
- [ ] Postgres server: npx -y @modelcontextprotocol/server-postgres postgresql://localhost:5432/mydb
- [ ] Brave Search: npx -y @modelcontextprotocol/server-brave-search with BRAVE_API_KEY
- [ ] stdio: local subprocess, no network, single client, best for development
- [ ] SSE: remote server, network-dependent, many clients, best for production
- [ ] Manage GitHub issues, generate code from Figma, connect through Zapier — natural language
- [ ] Three setup options: local stdio for development, remote SSE for production, enterprise for governance
- [ ] Security: review what each MCP server can access before enabling
- [ ] Security: use least-privilege API keys and tokens
- [ ] Security: filesystem server — restrict to specific directories
- [ ] Security: GitHub — use read-only tokens when possible, fine-grained PATs
- [ ] Security: Postgres — use read-only connections, dedicated user with SELECT only
- [ ] Security: audit which tools are called in conversation history
- [ ] Security: keep MCP server packages updated
- [ ] Security: use env vars for secrets, never hardcode in config
- [ ] Security: enterprise governance — single secure platform between AI and all systems
- [ ] Troubleshooting: verify command and args are correct
- [ ] Troubleshooting: check env vars and API keys are set properly
- [ ] Troubleshooting: use full path to npx/docker if not in PATH
- [ ] Troubleshooting: test server connection independently
- [ ] Troubleshooting: restart Cursor after adding server
- [ ] Troubleshooting: enable Agent mode in chat to see tools
- [ ] Troubleshooting: regenerate API keys if tool calls fail
- [ ] Read MCP developer guide for protocol
- [ ] Read build MCP server for server creation
- [ ] Read Claude Desktop MCP for Claude Desktop setup
- [ ] Read MCP transports for transport details
- [ ] Read MCP tools for tool development
- [ ] Test: filesystem server reads files from specified directories in Agent mode
- [ ] Test: GitHub server lists repos and issues with valid token
- [ ] Test: Context7 returns up-to-date library documentation
- [ ] Test: Agent mode discovers and calls tools with user approval
- [ ] Test: multiple servers work simultaneously
- [ ] Test: SSE transport connects to remote server
- [ ] Document server configs, transport choices, security policies, and troubleshooting steps
FAQ
How do you set up MCP servers in Cursor IDE?
Open Settings > Cursor Settings > MCP, add servers to mcp.json with command, args, and env. Cursor supports stdio and SSE transports. Cursor Docs: "Cursor supports MCP servers via Settings > Cursor Settings > MCP. Add servers to mcp.json configuration." TrueFoundry: "Cursor has emerged as one of the go-to MCP clients. MCP went from Anthropic project to vendor-neutral standard under Linux Foundation in December 2025." NxCode: "As of March 2026, MCP ecosystem has grown to over 5,000 community-built servers. Cursor Agent (AI) > MCP Client (built into Cursor) > MCP Server (external process) > External Tool (GitHub, database, files)." Steps: (1) Settings > Cursor Settings > MCP. (2) Click Add New MCP Server. (3) Enter name, select transport (stdio or sse). (4) Enter command and args for stdio, or URL for sse. (5) Add env vars if needed. (6) Click Add. (7) Server tools appear in Agent mode.
What MCP servers are most useful for Cursor IDE?
Filesystem for file access, GitHub for repo management, Context7 for library docs, Firecrawl for web scraping, and Postgres for database queries are the most popular MCP servers for Cursor. Bannerbear: "Manage GitHub issues, generate code from Figma designs, connect to thousands of apps through Zapier, and more using natural language within Cursor." NxCode: "Over 5,000 community-built servers available. Whatever tool or service you use, there is probably an MCP server for it." Natoma: "Cursor requires an MCP-compliant server that can respond to context queries. Three setup options: local stdio for development, remote SSE for production, enterprise platform for governance." Popular servers: Filesystem (file read/write), GitHub (repos, issues, PRs), Context7 (up-to-date library docs), Firecrawl (web scraping), Postgres (SQL queries), Brave Search (web search), Notion (knowledge management), Figma (design-to-code).
How does Cursor Agent mode use MCP tools?
In Agent mode, Cursor's AI can discover and call MCP server tools with user approval, using natural language to decide which tools to invoke. TrueFoundry: "Cursor Agent uses MCP client built into Cursor. Agent communicates with MCP server (external process) which connects to external tools. User approves tool calls before execution." NxCode: "Cursor Agent (AI) > MCP Client (built into Cursor) > MCP Server (external process) > External Tool. Agent discovers tools through MCP list calls and invokes them based on user query." Agent mode: (1) User types query in Cursor chat. (2) Agent receives available MCP tools. (3) Agent decides which tools to call. (4) User approves tool execution. (5) Agent calls tool via MCP protocol. (6) Tool result fed back to agent. (7) Agent generates response using tool output. (8) User can see which tools were called and approve each one.
How do you configure stdio vs SSE MCP servers in Cursor?
Cursor supports both stdio (local subprocess) and SSE (remote server) transports. Choose transport type when adding server in Settings > MCP. Cursor Docs: "Cursor supports stdio and SSE transports for MCP servers." Natoma: "Three setup options: local stdio for development, remote SSE for production, enterprise platform for governance. Ideal for development is local stdio." stdio config: {"mcpServers": {"server-name": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-name"], "env": {"KEY": "value"}}}}. SSE config: provide URL instead of command. stdio: local subprocess, no network, single client, best for development. SSE: remote server, network-dependent, many clients, best for production. Choose stdio for local tools (filesystem, local database). Choose SSE for remote services (hosted APIs, cloud databases).
What security considerations apply to MCP in Cursor?
MCP servers have access to external systems — review tool permissions, approve each tool call, and use least-privilege credentials. TrueFoundry: "MCP servers have access to external systems. Security considerations: review tool permissions, approve each tool call, use least-privilege credentials. MCP went to Linux Foundation in December 2025 — vendor-neutral standard co-founded with Block and OpenAI." Natoma: "Enterprise platform for governance — connecting any AI client to every application through one secure, governed platform." Security: (1) Review what each MCP server can access before enabling. (2) Cursor asks for user approval before each tool call. (3) Use least-privilege API keys and tokens. (4) Filesystem server: restrict to specific directories. (5) GitHub: use read-only tokens when possible. (6) Database: use read-only connections for queries. (7) Audit which tools are called in conversation history. (8) Keep MCP server packages updated. (9) Use env vars for secrets, never hardcode in config.
Want a self-hosted AI company brain that does all of this out of the box?
Book a demo →