Desktop MCP not authenticating for Live Meta Ads MCP

Support Help
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Official Meta Ads MCP with a static CLIENT_ID (our own Live Meta app) cannot finish desktop Connect. Cursor sends http://localhost:8787/callback. Meta Live apps cannot save that URI.

Development Connect works for an app Admin. Live is required so a Facebook user without an app role can Login.

Meta app is Live with valid OAuth Redirect URI: www.cursor.com/agents/mcp/oauth/callback
Adding localhost on Live (Meta refuses). App Review is approved for the Ads MCP scopes; this fails before consent.

Any Assistance or advise will be valuable to overcome this and use ur LIVE Meta App for Meta Ads to review and assit on campaigns

Steps to Reproduce

I can reproduce the error by removing my Meta App from Development Mode and Publish it to LIVE Mode

Expected Behavior

Desktop MCP OAuth uses already registered or a supported way to choose that URI when the provider cannot allowlist localhost.

Operating System

MacOS

Version Information

3.20.21 (Universal)

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey @vpatchuae, thanks for the detailed report!

On the desktop app, MCP OAuth always uses http://localhost:8787/callback as the redirect. The https://www.cursor.com/agents/mcp/oauth/callback address is the one used when you connect an MCP from the web (Cloud Agents on cursor.com). Since Meta only accepts https redirect URIs on a Live app, the desktop flow cannot complete against a Live app today. There is no setting to switch the desktop redirect yet.

Two things that should work in the meantime:

  1. Connect the Meta Ads MCP through Cloud Agents instead of the desktop app. Go to cursor.com/agents, open the + menu next to the prompt box, choose MCP, and add the server with the same configuration you use locally (if you are on a team, the same editor lives under Dashboard, then Integrations & MCP):
{
  "mcpServers": {
    "meta-ads": {
      "url": "https://mcp.facebook.com/ads",
      "auth": {
        "CLIENT_ID": "YOUR_META_APP_ID"
      }
    }
  }
}

Paste the App ID as a literal value. That surface authorizes with https://www.cursor.com/agents/mcp/oauth/callback, which you have already registered, so the Live app should accept it. Agents you run from cursor.com can then use the Meta Ads tools.

  1. If you need it in the desktop app right now, keep the Meta app in Development mode and add the Facebook accounts that need to sign in under App Roles (Testers or Developers). Development mode lets any account with a role log in, and Meta automatically allows http://localhost redirects in that mode, so the desktop Connect keeps working without adding the URI.

Could you let me know whether the Cloud Agents route completes the Meta login for you? That helps us confirm the gap is only on the desktop side.

7

Thanks Colin — we followed the Cloud Agents path.

On cursor.com/agents → + → MCP Servers we added:

{
  "meta-ads": {
    "url": "https://mcp.facebook.com/ads",
    "auth": {
      "CLIENT_ID": "137**70151004**6"
    }
  }
}

(Your full mcpServers wrapper cannot be saved in that editor — it errors Server "mcpServers" must have either a command or url. The block above is the same config without the file wrapper.)

Save succeeds. The Cloud MCP list then shows a red Error: “Server returned an unexpected response. It may not be an MCP server.” There is no Connect or Login button. We never reached Cursor Agent - Turn your ideas into code

Same URL + Client ID works on the desktop app while the Meta app is in Development (Hotmail / app role). We did not disconnect desktop; Development does not lock the app to one Cursor surface.

Live probe of https://mcp.facebook.com/ads: GET returns 405 (POST only). POST initialize returns 401 with WWW-Authenticate resource metadata. Cloud treats that as “not an MCP server” instead of starting OAuth.

So: desktop Live + localhost is still blocked as you described.

11

I’m having the same issue.

27

Hey @vpatchuae and @Marina_Carvalho_Alve! I’ve been digging into this a bit more.

The Connect flow in the desktop app always uses http://localhost:8787/callback as the redirect, and Meta does not accept that on a Live app. That is a Meta rule, and there is nothing we can change on our side to work around it, so a Live app cannot complete the login flow in the desktop app right now.

cursor.com/agents and Grok Bot. This is a separate problem. When our servers ask Meta for the sign-in details behind https://mcp.facebook.com/ads, Meta sometimes answers with the data we need and sometimes with a web page, and we do not know why it varies. When it is a web page you get the “Server returned an unexpected response” message with no Login button. Your configuration is correct. If you retry and a Login button does appear, the https callback you registered will work at that moment.

Workaround: use an access token. Meta’s Ads MCP officially accepts a user access token in place of the login flow (see the “User access token” section of Meta’s Ads MCP “Get started” page and https://developers.facebook.com/documentation/ads-commerce/marketing-api/get-started/authentication). With a token, Cursor never starts the login flow, so neither of the problems above applies, on desktop or on cursor.com/agents.

  1. Generate a token for your app. For one that does not expire, use a System User: Business Settings, then Users, then System Users, then Generate token. Pick your app, set expiration to Never, and assign the system user to the ad accounts you want to work on. Grant ads_mcp_management, ads_read, ads_management and business_management (add catalog_management, pages_show_list, instagram_basic if you need them).

  2. Desktop app, in mcp.json:

{
  "mcpServers": {
    "meta-ads": {
      "url": "https://mcp.facebook.com/ads",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}
  1. cursor.com/agents, in the MCP editor (no mcpServers wrapper there):
{
  "meta-ads": {
    "url": "https://mcp.facebook.com/ads",
    "headers": {
      "Authorization": "Bearer YOUR_TOKEN"
    }
  }
}

With a token nobody signs in through Cursor, so the app can stay Live and colleagues without an app role can use the tools. The trade-off is that everyone using that token acts as the same Meta identity with that token’s permissions.

Could you let us know whether the token route unblocks you?

28

Hi @Colin ,

The issue with the system user access token is that it is not allowed. I get this error:
“Admin system user tokens are not permitted on the Ads MCP server. Please use an Employee system user token.”

And when trying an employee system user token I get this error: "“This resource is restricted to certain users. Please verify your identity and try again”

29

Thanks Colin — the Bearer token path worked on Cursor desktop.

We swapped auth.CLIENT_ID for:

{
“url”: “https://mcp.facebook.com/ads”,
“headers”: {
“Authorization”: "Bearer "
}
}

After reload, Meta Ads MCP is Local · Connected with no Login/Logout. ads_get_ad_accounts returns our ad accounts and campaign/ad-set reads work on the accounts where Meta has enabled Ads MCP.

30

Hi @vpatchuae , would you mind sharing where/what kind of token you used to make it work?

My system user tokens are not working

31

Hi @Marina_Carvalho_Alve you need to make the user as Employee not Admin.

As @Colin mentioned Admin wont work.