Cursor 3 omitting trailing slash from MCP requests

rem.y · April 7, 2026, 8:36pm

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Cursor 3 is making its POST requests to the MCP server’s endpoint even when the slash is included in the configuration which causes either a 404 or a 307 into a 401 since it appears when it gets the 307 it next tries a GET request to the endpoint with the trailing slash but without the headers. Downgrading to 2.6 resolves the issue and it makes the requests with the included trailing slash (I can see in moesif/datadog the requests coming in with or without the slash depending on cursor version being used).

I’m having issues with both token auth and oauth but I think this is probably the cause of both and both oauth and token auth work fine on 2.6

I also kinda suspect this might be the cause of the 404 oauth issue in this post: Atlassian MCP plugin OAuth authentication fails at token exchange - #16 by Karlis_Melderis

Steps to Reproduce

MCP server config with trailing slash and token auth

{
    "mcpServers": {
      "my-token-auth-server": {
        "url": "https://my.host.com/mcp/",
        "headers": {
          "Authorization": "Bearer my-token"
        }
      }
    }
  }

Cursor 2 token MCP logs

2026-04-07 15:49:23.340 [info] Creating streamableHttp transport
2026-04-07 15:49:23.348 [info] Server creation in progress, waiting for completion
2026-04-07 15:49:23.756 [info] Connecting to streamableHttp server
2026-04-07 15:49:24.451 [info] Successfully connected to streamableHttp server
2026-04-07 15:49:24.452 [info] Storing streamableHttp client
2026-04-07 15:49:24.452 [info] [MCP Allowlist] Creating adapter with serverName="my-token-auth-server", identifier="project-0-my-project-my-token-auth-server"
2026-04-07 15:49:24.452 [info] CreateClient completed, server stored: true

Cursor 3 token MCP Logs

2026-04-07 15:55:49.869 [info] Server not yet created, returning empty offerings
2026-04-07 15:55:49.869 [info] [V2] Handling CreateClient action
2026-04-07 15:55:49.869 [info] [V2 FSM] connection:connect_start: conn=idle,auth=unknown -> conn=connecting,auth=unknown
2026-04-07 15:55:52.234 [warning] Error connecting to streamableHttp server, falling back to SSE: Streamable HTTP error: Error POSTing to endpoint: { "message": "Not Found" }
2026-04-07 15:55:53.490 [error] Error connecting to SSE server after fallback: SSE error: Non-200 status code (404) SSE error: Non-200 status code (404)
2026-04-07 15:55:53.517 [warning] Connection failed: SSE error: Non-200 status code (404)
2026-04-07 15:55:53.527 [warning] [V2 FSM] connection:connect_failure: conn=connecting,auth=unknown -> conn=failed,auth=unknown
2026-04-07 15:55:53.527 [info] CreateClient completed, connected: false, statusType: error

Config for using oauth

{
	"mcpServers": {
      "my-oauth-server": {
        "url": "https://my.host.com/mcp/"
    }
  }
}

Cursor 2 oauth MCP Logs

2026-04-07 15:41:30.470 [info] Creating streamableHttp transport
2026-04-07 15:41:30.470 [info] Server creation in progress, waiting for completion
2026-04-07 15:41:30.814 [info] Connecting to streamableHttp server
2026-04-07 15:41:31.444 [info] No stored client information found
2026-04-07 15:41:31.450 [info] Using redirect URL
2026-04-07 15:41:31.749 [info] Saving client information
2026-04-07 15:41:31.753 [info] Using redirect URL
2026-04-07 15:41:31.756 [info] Using redirect URL
2026-04-07 15:41:31.757 [info] Using redirect URL
2026-04-07 15:41:31.757 [info] Saving PKCE code verifier
2026-04-07 15:41:31.759 [info] Redirect to authorization requested
2026-04-07 15:41:31.760 [info] Stored server URL for OAuth flow
2026-04-07 15:41:31.760 [info] OAuth provider needs auth callback during connection
2026-04-07 15:41:31.760 [warning] UnauthorizedError in onerror (current status: 'needsAuth'): Unauthorized
2026-04-07 15:41:31.761 [warning] Auth-related error connecting to streamableHttp server, returning transport
2026-04-07 15:41:31.761 [info] Successfully connected to streamableHttp server
2026-04-07 15:41:31.761 [info] Storing streamableHttp client
2026-04-07 15:41:31.761 [info] [MCP Allowlist] Creating adapter with serverName="my-oauth-server", identifier="project-0-my-project-my-oauth-server"
2026-04-07 15:41:31.761 [info] CreateClient completed, server stored: true
2026-04-07 15:41:32.901 [info] Handling LogoutServer action
2026-04-07 15:41:32.902 [info] Clearing stored OAuth data
2026-04-07 15:41:32.938 [info] Successfully cleared OAuth tokens
2026-04-07 15:41:32.938 [info] Cleaning up, reason: logout_server
2026-04-07 15:41:32.938 [warning] [V1] needsAuth -> disconnected
2026-04-07 15:41:32.939 [info] Handling ReloadClient action
2026-04-07 15:41:32.942 [info] Creating streamableHttp transport
2026-04-07 15:41:33.204 [info] Connecting to streamableHttp server
2026-04-07 15:41:33.816 [info] No stored client information found
2026-04-07 15:41:33.820 [info] Using redirect URL
2026-04-07 15:41:34.242 [info] Saving client information
2026-04-07 15:41:34.246 [info] Using redirect URL
2026-04-07 15:41:34.249 [info] Using redirect URL
2026-04-07 15:41:34.249 [info] Using redirect URL
2026-04-07 15:41:34.249 [info] Saving PKCE code verifier
2026-04-07 15:41:34.252 [info] Redirect to authorization requested
2026-04-07 15:41:34.253 [info] Stored server URL for OAuth flow
2026-04-07 15:41:34.253 [info] OAuth provider needs auth callback during connection
2026-04-07 15:41:34.254 [warning] UnauthorizedError in onerror (current status: 'needsAuth'): Unauthorized
2026-04-07 15:41:34.254 [warning] Auth-related error connecting to streamableHttp server, returning transport
2026-04-07 15:41:34.254 [info] Successfully connected to streamableHttp server
2026-04-07 15:41:34.254 [info] Storing streamableHttp client
2026-04-07 15:41:34.254 [info] [MCP Allowlist] Creating adapter with serverName="my-oauth-server", identifier="project-0-my-project-my-oauth-server"
2026-04-07 15:41:34.254 [info] Successfully reloaded client
2026-04-07 15:41:38.800 [info] Received OAuth callback with code
2026-04-07 15:41:39.193 [info] Using redirect URL
2026-04-07 15:41:39.193 [info] Using redirect URL
2026-04-07 15:41:39.193 [info] Using redirect URL
2026-04-07 15:41:39.194 [info] Using redirect URL
2026-04-07 15:41:39.444 [info] Saving tokens
2026-04-07 15:41:39.446 [info] OAuth authorization completed
2026-04-07 15:41:39.448 [info] Handling ReloadClient action
2026-04-07 15:41:39.451 [info] Cleaning up, reason: reload_client
2026-04-07 15:41:39.451 [warning] [V1] needsAuth -> disconnected
2026-04-07 15:41:39.451 [info] Creating streamableHttp transport
2026-04-07 15:41:39.692 [info] Connecting to streamableHttp server
2026-04-07 15:41:40.211 [info] Successfully connected to streamableHttp server
2026-04-07 15:41:40.211 [info] Storing streamableHttp client
2026-04-07 15:41:40.211 [info] [MCP Allowlist] Creating adapter with serverName="my-oauth-server", identifier="project-0-my-project-my-oauth-server"
2026-04-07 15:41:40.212 [info] Successfully reloaded client

Cursor 3 oauth MCP logs (the 401 at the bottom comes from a GET request w/o auth headers/token following a 307 from a request with no trailing slash)

2026-04-07 16:24:40.784 [info] [V2] Handling CreateClient action
2026-04-07 16:24:40.784 [info] [V2 FSM] connection:connect_start: conn=idle,auth=unknown -> conn=connecting,auth=unknown
2026-04-07 16:24:42.531 [info] No stored client information found
2026-04-07 16:24:42.538 [info] Using redirect URL
2026-04-07 16:24:42.806 [info] Saving client information
2026-04-07 16:24:42.832 [info] Using redirect URL
2026-04-07 16:24:42.840 [info] Using redirect URL
2026-04-07 16:24:42.840 [info] Using redirect URL
2026-04-07 16:24:42.840 [info] Saving PKCE code verifier
2026-04-07 16:24:42.899 [info] MCP OAuth redirect to authorization
2026-04-07 16:24:42.908 [info] Stored server URL for OAuth flow
2026-04-07 16:24:42.908 [info] OAuth provider needs auth callback during connection
2026-04-07 16:24:42.908 [info] Connect failed after auth_required; returning needsAuth (streamableHttp)
2026-04-07 16:24:42.909 [info] MCP OAuth needsAuth (v2)
2026-04-07 16:24:42.909 [warning] [V2 FSM] connection:connect_failure: conn=connecting,auth=unknown -> conn=transient_failure,auth=unknown
2026-04-07 16:24:42.909 [info] CreateClient completed, connected: false, statusType: needsAuth
2026-04-07 16:24:46.722 [info] [V2] Handling LogoutServer action
2026-04-07 16:24:46.722 [info] Clearing stored OAuth data
2026-04-07 16:24:46.737 [info] Successfully cleared OAuth tokens
2026-04-07 16:24:46.737 [info] [V2] Removing client, reason: logout_server
2026-04-07 16:24:46.740 [info] [V2] Handling ReloadClient action
2026-04-07 16:24:46.740 [info] [V2 FSM] connection:connect_start: conn=idle,auth=unknown -> conn=connecting,auth=unknown
2026-04-07 16:24:48.151 [info] No stored client information found
2026-04-07 16:24:48.154 [info] Using redirect URL
2026-04-07 16:24:48.383 [info] Saving client information
2026-04-07 16:24:48.387 [info] Using redirect URL
2026-04-07 16:24:48.389 [info] Using redirect URL
2026-04-07 16:24:48.389 [info] Using redirect URL
2026-04-07 16:24:48.390 [info] Saving PKCE code verifier
2026-04-07 16:24:48.395 [info] MCP OAuth redirect to authorization
2026-04-07 16:24:48.403 [info] Stored server URL for OAuth flow
2026-04-07 16:24:48.403 [info] OAuth provider needs auth callback during connection
2026-04-07 16:24:48.403 [info] Connect failed after auth_required; returning needsAuth (streamableHttp)
2026-04-07 16:24:48.404 [info] MCP OAuth needsAuth (v2)
2026-04-07 16:24:48.404 [warning] [V2 FSM] connection:connect_failure: conn=connecting,auth=unknown -> conn=transient_failure,auth=unknown
2026-04-07 16:24:48.404 [info] ReloadClient completed, connected: false, statusType: needsAuth
2026-04-07 16:24:52.290 [info] Received OAuth callback with code
2026-04-07 16:24:53.202 [info] Using attempt-scoped OAuth client information for callback flow
2026-04-07 16:24:53.207 [info] Using redirect URL
2026-04-07 16:24:53.476 [info] MCP OAuth tokens persisted
2026-04-07 16:24:53.485 [info] MCP OAuth callback exchange completed
2026-04-07 16:24:53.487 [info] [V2] Handling ReloadClient action
2026-04-07 16:24:53.487 [info] [V2 FSM] connection:connect_start: conn=idle,auth=unknown -> conn=connecting,auth=unknown
2026-04-07 16:24:55.334 [info] Using redirect URL
2026-04-07 16:24:55.739 [info] MCP OAuth tokens persisted
2026-04-07 16:24:55.742 [info] OAuth tokens saved
2026-04-07 16:24:56.434 [error] Auth-related error connecting to streamableHttp server: Streamable HTTP error: Server returned 401 after successful authentication Streamable HTTP error: Server returned 401 after successful authentication
2026-04-07 16:24:56.437 [info] MCP OAuth needsAuth (v2)
2026-04-07 16:24:56.437 [warning] [V2 FSM] connection:connect_failure: conn=connecting,auth=unknown -> conn=transient_failure,auth=unknown
2026-04-07 16:24:56.437 [info] ReloadClient completed, connected: false, statusType: needsAuth

Expected Behavior

requests made to MCP server include trailing slash from config

Operating System

MacOS

Version Information

Cursor 2 info

Version: 2.6.22
VSCode Version: 1.105.1
Commit: c6285feaba0ad62603f7c22e72f0a170dc8415a0
Date: 2026-03-27T15:59:31.561Z
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Darwin x64 24.6.0

Cursor 3 info

Version: 3.0.12
VSCode Version: 1.105.1
Commit: a80ff7dfcaa45d7750f6e30be457261379c29b00
Date: 2026-04-04T00:13:18.452Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Darwin x64 24.6.0

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

mohitjain · April 8, 2026, 7:22am

Hi @rem.y,

Thanks for the detailed report with the side-by-side logs. You’re right – this is a confirmed regression in Cursor 3. We’ve flagged it for the team.

Unfortunately, there’s no client-side workaround right now. If your server can be configured to accept requests without the trailing slash (e.g., adding a route alias or disabling redirect-on-missing-slash), that would work around it.

Your hunch about a connection to the Atlassian MCP OAuth 404 thread is reasonable if those endpoints also require trailing slashes.

We’ll update here when this is resolved.

Topic		Replies	Views
MCP PKCE oAuth flow is not using refresh token Bug Reports mcp , login	14	134	April 10, 2026
> Security: MCP tools with long-polling + alwaysApply rules enable infinite conversation loops, bypassing usage limits Bug Reports mcp , rules , security	2	165	April 4, 2026
Atlassian MCP plugin OAuth authentication fails at token exchange Bug Reports mcp , ssh , plugins	15	747	April 10, 2026
Auto-reconnection to MCP servers is STILL broken in 3.0 (runs multiple times in parallel, then fails). on/off works OK Bug Reports mcp	2	14	April 10, 2026
MCP headers config ignored when server has OAuth discovery Bug Reports mcp	4	99	April 10, 2026