G2 MCP OAuth stuck on “Waiting for callback” in Cursor Desktop

[d_d6]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I’m trying to connect G2’s remote MCP server to Cursor Desktop using a registered G2 OAuth app with Client ID + Client Secret.

Cursor recognizes the G2 MCP server and successfully opens G2’s OAuth consent page. I can approve the app with my G2 account, but Cursor remains stuck on “Waiting for callback” / “Needs Authentication.”

MCP URL: mcp.g2.com/mcp

The G2 OAuth app has Cursor redirect URIs registered, including:
localhost:8787/callback

Peerbound MCP works normally in the same Cursor setup, so this appears specific to the G2 OAuth callback/code exchange.

Steps to Reproduce

Create a G2 OAuth app with Client ID + Client Secret.
Register localhost:8787/callback as a redirect URI.
Add G2 to ~/.cursor/mcp.json as a remote MCP server using mcp.g2.com/mcp.
Open Cursor Settings → MCPs.
Click Authenticate for G2.
G2 OAuth consent page opens successfully.
Click Sign Up / approve access.
Cursor remains stuck on “Waiting for callback” and G2 never becomes connected.

Expected Behavior

After approving the G2 OAuth consent screen, G2 should redirect back to Cursor, Cursor should complete the OAuth code exchange, and the G2 MCP server should move to Connected with its tools available.

Screenshots / Screen Recordings

Operating System

MacOS

Version Information

3.17.8

For AI issues: which model did you use?

N/A - this is an MCP OAuth authentication issue, not an AI model issue.

For AI issues: add Request ID with privacy disabled

N/A - no AI request involved.

Additional Information

G2 MCP documentation

G2 reaches the consent screen and recognizes my account correctly. The failure occurs only after approval, when Cursor waits for the OAuth callback.

I also found similar Cursor community reports where OAuth completes in the browser but Cursor does not complete the callback/code exchange.

Peerbound MCP and Zapier MCP continue to work in the same Cursor environment.

Does this stop you from using Cursor

No - Cursor works, but with this issue

[mohitjain (Mohit)]

Hey @d_d6, thanks for the detailed report - your setup is actually correct (that’s why Peerbound and Zapier work in the same Cursor).

What you’re hitting is on G2’s side: when they redirect back after you approve, their server leaves out the OAuth state parameter, which Cursor requires on the callback for security. Without it, the callback isn’t accepted and Cursor keeps waiting. G2’s own MCP docs note this under “Handle the OAuth callback” - their server “doesn’t include the state parameter.” You can confirm it: right after approving, the browser tab should land on a localhost:8787 page that says “Not found.”

The fix has to come from G2 - their server needs to echo state back on the redirect. Raising it with G2 support is the fastest path, nothing changes on your end once they do.

One heads-up from their docs for after that’s fixed: if you hit a 401 right after connecting, you’ll need “cross-application token introspection” enabled on your G2 OAuth app - G2’s team can turn that on.

[d_d6]

Thanks @mohitjain so much for digging into this and explaining the root cause. This was really helpful and confirms I can stop troubleshooting the Cursor side. I’m going to raise the state callback issue and cross-application token introspection with G2 support. Really appreciate the help!