Grok Bot custom MCP OAuth fails before sign-in: redirect_uri not allowed

Support Bug Reports
, ,
16

@atsuya046, thanks for checking and writing this up in detail. I need to correct myself here. Earlier I said that cursor:// can’t be added to the Cloudflare allowlist. It turns out this is possible through the Access Applications API, and the Managed OAuth guide doesn’t match the API reference on this point.

@LiuChunYin, @Vaughan-g-aus, you both use Cloudflare Access, so please try the method from the post above: Grok Bot custom MCP OAuth fails before sign-in: redirect_uri not allowed - #14 by atsuya046. In short:

  1. Do a GET for the current config of the Access application that protects the MCP server.
  2. Add these entries to oauth_configuration.dynamic_client_registration.allowed_uris, without removing any existing ones:
    • cursor://anysphere.cursor-mcp/oauth/callback
    • https://www.cursor.com/agents/mcp/oauth/callback
  3. Make sure allow_any_on_localhost and allow_any_on_loopback are enabled.
  4. Do a PUT with the full config.

Please note that this setting applies to the whole application. If it protects multiple hostnames, the change will affect all of them. If registration works but OAuth fails at the next step, please post the exact error text here.

@antigenerisis, for Home Assistant through Nabu Casa, this method won’t work. There, the list of allowed redirect URIs is set by the server, not by you. To make it send only https and localhost callbacks, we’d need a change on our side. We’re tracking this issue, but I can’t share an ETA yet. Please send the exact error text shown by Grok Bot or Home Assistant during connection. That’ll help me confirm whether it’s the same issue.

If there are any updates, I’ll post them here.