Composio MCP oAuth Issue

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Composio MCP Oauth not appearing when trying to connect.

Steps to Reproduce

  1. Install composio mcp How to connect Cursor MCP with Cursor
  2. Add and wait to connect
  3. Press connect and it goes to https://connect.composio.dev/mcp but no oauth
  4. Get this error error “Missing authentication: provide Authorization: Bearer or x-consumer-api-key header”
  5. Stuck on waiting for callback

Expected Behavior

Should be able to oauth and log in

Screenshots / Screen Recordings

Screenshot 2026-05-25 180037.png
Screenshot 2026-05-25 180037.png1160×338 9.7 KB

Operating System

Windows 10/11

Version Information

Version: 3.5.33 (user setup)

Does this stop you from using Cursor

No - Cursor works, but with this issue

4

Hi @Cambo, sorry you had issue connecting Composio to Cursor, tho I would like to inform you that composio has been actively dealing with a security incident, and that it was still ongoing to this day, I also had similar issue with some of my services, and I’m now 100% sure this has to be caused by this secutiry issue, see link for more detail Composio May 2026 Security Incident | Composio

6

Oh wow, thank you for sharing this. I was just starting to use it for the first time so maybe I will wait a bit.

8

Hey, the error is coming from Composio connect.composio.dev/mcp, not from Cursor. Their endpoint requires an Authorization: Bearer or x-consumer-api-key header before the OAuth flow starts.

@Tom_Coustols pointed in the right direction above. Composio currently has an active security incident: Composio May 2026 Security Incident | Composio. That’s probably what’s breaking the connection flow. It makes sense to wait until they roll back or fix it.

Once things are back to normal, Composio MCP still requires you to manually set the API key in headers in .cursor/mcp.json, per their official Cursor instructions. Without that header, the server will block requests with the same message.

If the error is still there after they fix the incident, share your mcp.json here with secrets removed and we’ll check the config.