If I understand correctly, the OAuth flow in the Neon MCP server is currently based on this spec, which has since changed significantly in the latest draft version.
Previously, the MCP server acted as both the MCP server and the OAuth provider. In other words, the Neon MCP Client would communicate with the Neon MCP Server, which is responsible for handling /authorize, /callback, and redirecting to the Neon Authorization Server.
In the draft spec, this has been greatly simplified for MCP server developers. You can read more about these changes in this PR.
As for a working example that integrates with Cursor: I modified the official TypeScript MCP server SDK example a bit , and it worked perfectly! It runs a Streamable HTTP MCP server along with a dummy authorization server—both on localhost.
Edit: Message is split to 2 due to new user links limitation