Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
Gmail MCP OAuth Browser Not Opening - Stuck in Auth Loop
Gmail MCP server OAuth flow initiates but fails to open browser for authorization, causing the server to remain in an unusable “Unauthorized” state. The “Logout” button clears tokens but does not trigger re-authentication.
Steps to Reproduce
Add Gmail MCP to ~/.cursor/mcp.json:
{
“mcpServers”: {
“gmail-mcp”: {
“url”: “gmailmcp.googleapis/mcp/v1”,
“auth”: {
“type”: “oauth”,
“CLIENT_ID”: “.apps.googleusercontent.com”,
“CLIENT_SECRET”: “<redacted — do not paste real secrets in bug reports>”,
“scopes”: [
“auth/gmail.readonly”,
“auth/gmail.compose”
]
}
}
}
}
Restart Cursor
Gmail MCP appears as “Connected” with “12 tools enabled” and a “Logout” button
Try to use a Gmail tool (e.g., “List my recent emails”)
Server returns “Unauthorized” error
Expected Behavior
When the Gmail tool is called without valid OAuth tokens:
Cursor should detect the authentication is required
The MCP server state should transition to needsAuth (like Amplitude/Miro plugins do)
A browser window should open to Google’s OAuth consent page
After user authorizes, the callback should return to Cursor
Gmail tools should work
Screenshots / Screen Recordings
Operating System
MacOS
Version Information
Cursor Version: 3.4.20 (arm64)
OS: macOS 14.4 (Darwin 25.4.0)
MCP Server: Gmail MCP (https://gmailmcp.googleapis.com/mcp/v1)
OAuth Config: Standard Google OAuth2 with PKCE
For AI issues: which model did you use?
Composer 2
Additional Information
Actual behavior:
Server state transitions from connected → error (not needsAuth)
Browser window never opens
No user notification or prompt to authorize
Server immediately returns “Unauthorized” error
Clicking “Logout” clears tokens but doesn’t trigger re-auth
Workaround Attempts (All Failed):
✗ Clicking “Logout” multiple times
✗ Removing and re-adding server config
✗ Clearing OAuth state from SQLite database
✗ Restarting Cursor
✗ Clearing OAuth attempt files
Additional Details:
No macOS permission prompts or notifications appeared
System can open browsers normally (tested with open command)
Gmail MCP API endpoint is accessible (returns tool list without auth)
Logout button works (clears tokens from database) but doesn’t trigger re-auth flow
OAuth attempts are logged but browser launch never happens
Does this stop you from using Cursor
No - Cursor works, but with this issue