Cursor IBKR MCP OAuth fails: SSL client auth certificate needed

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

MCP OAuth never opens for official IBKR connector — `ERR_SSL_CLIENT_AUTH_CERT_NEEDED

I’m trying to connect Interactive Brokers’ official public MCP server in Cursor. The same IBKR MCP connector works in Claude (login popup appears, I authenticate, and account data is retrieved). In Cursor, connection fails before any OAuth / login popup is shown.

Environment

  • App: Cursor 3.14.7
  • OS: macOS 26.5.2 (Build 25F84)
  • VPN: not in use
  • MCP server name: ibkr
  • MCP URL: https://api.ibkr.com/v1/api/mcp-public
  • Config style: remote URL MCP in ~/.cursor/mcp.json

Ask

  1. Can Cursor’s MCP HTTP client handle IBKR’s TLS/client-cert challenge so OAuth can proceed?
  2. Is there a workaround/setting to ignore optional client certs or open the authorize URL manually?
  3. Please advise if this is a known issue with remote MCP OAuth to api.ibkr.com.

Happy to provide full mcp-server-user-ibkr.log / mcpprocess.log excerpts.

Thanks,

Steps to Reproduce

Cursor fails during streamable HTTP connect. No login popup appears. mcp_auth times out. Server stays in error / tool discovery failed.

Error (repeated)

connecting streamableHttp for "ibkr" (user-ibkr)
MCP HTTP exchange failed
Transient error connecting to streamableHttp server: net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED
Connection failed: net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED
[V2 FSM] connection:connect_failure: conn=connecting,auth=unknown -> conn=failed,auth=unknown

OAuth loopback briefly listens on localhost:8787, then expires without a completed login flow.

Comparison

  • Claude: same IBKR MCP URL → login popup → successful auth → portfolio/account data retrieved
  • Cursor: fails at TLS with ERR_SSL_CLIENT_AUTH_CERT_NEEDED before popup

This strongly suggests a Cursor Electron / MCP HTTP client TLS issue (client certificate requested/required), not an IBKR account or URL misconfiguration.

Expected Behavior

  1. Add/enable IBKR MCP in Cursor
  2. Cursor starts OAuth / opens IBKR secure login (system browser or in-app popup)
  3. I log in and authorize
  4. Tools become available

Operating System

MacOS

Version Information

Cursor 3.14.7

For AI issues: which model did you use?

Grok

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey, thanks for the detailed report with logs and the comparison to Claude, it really helps.

I’ll reply point by point:

  1. Is this a known issue
    Yes, this is a known class of issue with remote MCP over streamableHTTP when the server requests a TLS client certificate. The connection fails during the handshake ERR_SSL_CLIENT_AUTH_CERT_NEEDED before OAuth starts, so the login popup never appears. We’re tracking this.

  2. What matters
    In 3.14.7 this path should already be handled correctly, so your build shouldn’t crash like this. That points to either a setting or a remaining edge case we want to understand from your logs. Two things:

  • Check the setting http.fetchAdditionalSupport (Settings → search for fetchAdditionalSupport or HTTP: Fetch Additional Support). It should be on true by default. If it’s off, turn it on and restart Cursor. That can force the old TLS path.
  • Send an excerpt from the MCP log around the connection attempt to ibkr (the mcpprocess.log or mcp-server-user-ibkr.log you mentioned). You can find it via the Output panel, select the MCP channel in the dropdown, or in ~/Library/Application Support/Cursor/logs/. This will show which stack the request is using.
  1. Workaround right now
    Connect IBKR as a stdio server via mcp-remote. It uses the Node stack and doesn’t trip on the client cert challenge. In ~/.cursor/mcp.json:
{
  "mcpServers": {
    "ibkr": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.ibkr.com/v1/api/mcp-public"]
    }
  }
}

There’s no separate setting right now to attach or ignore a client cert, or to open the authorize URL manually. The failure happens before OAuth, so manually starting login won’t help. The stdio option above is the most reliable workaround.

Let me know if the workaround helped, and please attach the log so we can see why this is happening on 3.14.7.

7

Hey Dean,

Thanks for your response.

ibkr

2026-08-04 14:57:38.299 [info] [MCPService] [MCPService] createClient: identifier="user-ibkr", serverName="ibkr"

2026-08-04 14:57:38.400 [info] [Shared MCP process] connecting streamableHttp for "ibkr" (user-ibkr)

2026-08-04 14:57:38.400 [info] [Shared MCP process] [V2 FSM] connection:connect_start: conn=idle,auth=unknown -> conn=connecting,auth=unknown

2026-08-04 14:57:38.612 [warning] [Shared MCP process] MCP HTTP exchange completed

2026-08-04 14:57:39.028 [warning] [Shared MCP process] MCP HTTP exchange failed

2026-08-04 14:57:39.029 [warning] [Shared MCP process] Transient error connecting to streamableHttp server: net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED

2026-08-04 14:57:39.029 [warning] [Shared MCP process] Connection failed: net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED

2026-08-04 14:57:39.029 [warning] [Shared MCP process] [V2 FSM] connection:connect_failure: conn=connecting,auth=unknown -> conn=failed,auth=unknown

2026-08-04 14:58:03.015 [info] [MCPService] [MCPService] createClient completed for server: user-ibkr, connected=false, statusType=disconnected

Sure, stdio works.

2026-08-04 15:04:45.176 [info] [Shared MCP process] connecting stdio for "ibkr-tmp" (user-ibkr-tmp)
2026-08-04 15:04:45.176 [info] [Shared MCP process] [V2 FSM] connection:connect_start: conn=idle,auth=unknown -> conn=connecting,auth=unknown
2026-08-04 15:04:45.176 [info] [Shared MCP process] MCP stdio spawn policy decision: sandboxed=false, sandboxReason=controls_disabled, networkControlsEnabled=false, mcpNetworkMode=unset, mcpNetworkAllowlistCount=0, mcpNetworkDenylistCount=0, localAgentNetworkAllowlistCount=0, sandboxPolicyHash=dbad6ab7a53b8aaa3269e0c907d30e5e1483298ffc76de0456eeb31b7d11df5e
2026-08-04 15:04:45.184 [info] [MCPService] [MCPService] createClient: identifier="user-ibkr-tmp", serverName="ibkr-tmp"
2026-08-04 15:04:45.184 [info] [MCPService] [MCPService] createClient completed for server: user-ibkr-tmp, statusType=initializing, success=true
2026-08-04 15:04:45.188 [info] [MCPService] [MCPService] createClient: identifier="user-ibkr-tmp", serverName="ibkr-tmp"
2026-08-04 15:04:45.190 [info] [MCPService] [MCPService] createClient completed for server: user-ibkr-tmp, statusType=initializing, success=true
2026-08-04 15:04:47.023 [error] [Shared MCP process] [63923] Using automatically selected callback port: 40811
 undefined
2026-08-04 15:04:47.023 [error] [Shared MCP process] [63923] Discovering OAuth server configuration...
 undefined
2026-08-04 15:04:47.693 [error] [Shared MCP process] [63923] Discovered authorization server: https://api.ibkr.com/oauth2
 undefined
2026-08-04 15:04:47.693 [error] [Shared MCP process] [63923] [63923] Connecting to remote server: https://api.ibkr.com/v1/api/mcp-public
 undefined
2026-08-04 15:04:47.693 [error] [Shared MCP process] [63923] Using transport strategy: http-first
 undefined
2026-08-04 15:04:48.617 [error] [Shared MCP process] [63923] 
Please authorize this client by visiting:
https://api.ibkr.com/oauth2/authorize?response_type=code&client_id=1a0f7e03-8de5-48d4-9c03-d8b3cb52893c&code_challenge=6gXY6stnPzYKhm6LWkcZoIzXzKRWd7-MK4SdGpi3szo&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A40811%2Foauth%2Fcallback&state=d9144e9d-555e-47eb-b160-511474c3b800&scope=mcp.read+mcp.write&resource=https%3A%2F%2Fapi.ibkr.com%2Fv1%2Fapi%2Fmcp-public

 undefined
2026-08-04 15:04:48.620 [error] [Shared MCP process] [63923] Browser opened automatically.
 undefined
2026-08-04 15:04:48.621 [error] [Shared MCP process] [63923] Authentication required. Initializing auth...
 undefined
2026-08-04 15:04:48.621 [error] [Shared MCP process] [63923] Initializing auth coordination on-demand
 undefined
2026-08-04 15:04:48.622 [error] [Shared MCP process] [63923] OAuth callback server running at http://127.0.0.1:40811
 undefined
2026-08-04 15:04:48.622 [error] [Shared MCP process] [63923] Creating lockfile for server 9264be6b3462a17d331b92a49692d468 with process 63923 on port 40811
 undefined
2026-08-04 15:04:48.623 [error] [Shared MCP process] [63923] Authentication required. Waiting for authorization...
 undefined
2026-08-04 15:05:37.504 [error] [Shared MCP process] [63923] Auth code received, resolving promise
 undefined
2026-08-04 15:05:37.507 [error] [Shared MCP process] [63923] Completing authorization...
 undefined
2026-08-04 15:05:38.719 [error] [Shared MCP process] [63923] Recursively reconnecting for reason: authentication-needed
[63923] [63923] Connecting to remote server: https://api.ibkr.com/v1/api/mcp-public
 undefined
2026-08-04 15:05:38.719 [error] [Shared MCP process] [63923] Using transport strategy: http-first
 undefined
2026-08-04 15:05:39.165 [error] [Shared MCP process] [63923] Connected to remote server using StreamableHTTPClientTransport
 undefined
2026-08-04 15:05:39.167 [error] [Shared MCP process] [63923] Local STDIO server running
[63923] Proxy established successfully between local STDIO and remote StreamableHTTPClientTransport
[63923] Press Ctrl+C to exit
[63923] [Local→Remote] initialize
[63923] {
  "jsonrpc": "2.0",
  "id": 0,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-11-25",
    "capabilities": {
      "elicitation": {
        "form": {}
      },
      "roots": {
        "listChanged": false
      },
      "extensions": {
        "io.modelcontextprotocol/ui": {
          "mimeTypes": [
            "text/html;profile=mcp-app"
          ]
        }
      }
    },
    "clientInfo": {
      "name": "cursor-vscode (via mcp-remote 0.1.37)",
      "version": "1.0.0"
    }
  }
}
 undefined
2026-08-04 15:05:39.357 [error] [Shared MCP process] [63923] [Remote→Local] 0
 undefined
2026-08-04 15:05:39.359 [info] [Shared MCP process] Successfully connected to stdio server
2026-08-04 15:05:39.359 [info] [Shared MCP process] [V2 FSM] connection:connect_success: conn=connecting,auth=unknown -> conn=connected,auth=unknown
2026-08-04 15:05:39.359 [error] [Shared MCP process] [63923] [Local→Remote] notifications/initialized
 undefined
2026-08-04 15:05:39.360 [error] [Shared MCP process] [63923] [Local→Remote] tools/list
 undefined
2026-08-04 15:05:39.602 [error] [Shared MCP process] [63923] [Remote→Local] 1
 undefined
2026-08-04 15:05:39.631 [error] [Shared MCP process] [63923] [Local→Remote] prompts/list
 undefined
2026-08-04 15:05:39.843 [error] [Shared MCP process] [63923] [Remote→Local] 2
 undefined
2026-08-04 15:05:39.845 [error] [Shared MCP process] [63923] [Local→Remote] resources/list
 undefined
2026-08-04 15:05:40.031 [error] [Shared MCP process] [63923] [Remote→Local] 3
 undefined
2026-08-04 15:06:58.142 [error] [Shared MCP process] [63923] [Local→Remote] tools/call
 undefined
2026-08-04 15:06:58.524 [error] [Shared MCP process] [63923] [Remote→Local] 4
 undefined
2026-08-04 15:07:01.066 [error] [Shared MCP process] [63923] [Local→Remote] tools/call
 undefined
2026-08-04 15:07:01.455 [error] [Shared MCP process] [63923] [Remote→Local] 5
 undefined

http setting is default and set to true (on vscode).

Looking forward to hearing fix for streamableHTTP as well.

8

Thanks, the logs and the confirmation about http.fetchAdditionalSupport are exactly what we needed. Since the default setting is true and streamableHTTP still fails with ERR_SSL_CLIENT_AUTH_CERT_NEEDED, it’s definitely not your config. I’ve shared your case and the logs with the team, this is a known issue we’re tracking. No ETA yet, I’ll post an update in the thread when I have one.

For now, please stick with stdio since it runs the whole flow without errors.