Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
Connecting Cursor to the hosted Salesforce Marketing Cloud Engagement (MCE) MCP server fails during OAuth.
Salesforce’s MCE MCP team reproduced the failure on the latest Cursor build. They report the cause is on the Cursor side: during OAuth registration / auth, Cursor includes a custom-scheme redirect URI (cursor://anysphere.cursor-mcp/oauth/callback) along with localhost callbacks. MCE MCP follows the OAuth spec strictly and rejects non-http/https redirect URIs, so the whole request is rejected. That leads to /authorize returning HTTP 400 and re-auth not completing.
Salesforce confirmed:
This is a known Cursor-side issue, not an MCE MCP server misconfiguration
Documented/validated clients (Claude Code, Gemini CLI) connect successfully with compliant callbacks
Allowlisting only localhost on the provider is not enough when Cursor still includes the custom-scheme URI in the set
Related Cursor threads:
Steps to Reproduce
Configure a remote Streamable HTTP MCP server pointing at Salesforce MCE MCP (EU or US hosted URL pattern from Salesforce docs), with static CLIENT_ID in mcp.json per Cursor static OAuth guidance.
In SFMC, use a Public App Installed Package with the documented HTTPS MCP OAuth callback redirect URI (Salesforce does not accept http://localhost:… or cursor://… in that UI).
In Cursor Settings → Tools & MCP, click Authenticate / Connect.
Browser opens the MCE MCP /authorize URL.
Observe HTTP 400 / auth failure before successful login completes.
Expected Behavior
Cursor should only register/send OAuth redirect URIs that are standards-compliant (http://localhost:… / https://…), never custom-scheme URIs, so spec-compliant providers like MCE MCP can complete auth. Static-client flows should not include cursor:// in the redirect URI set.
Operating System
Windows 10/11
Version Information
Version: 3.14.27 (user setup)
VS Code Extension API: 1.128.0
Commit: 047548b00c1a079373d74d00183f32510a4a41e0
Date: 2026-08-04T03:29:11.183Z
Layout: Agent Window
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.291
OS: Windows_NT x64 10.0.26200
Additional Information
Provider redirect URI is constrained to the Salesforce-documented HTTPS MCP callback; localhost/custom-scheme cannot be added in SFMC Installed Packages.
Same class of failure as the custom-scheme DCR bug already tracked above.
Request: fully retire custom-scheme callbacks for MCP OAuth (DCR and static client flows) so MCE MCP and similar strict providers work in Cursor.
Does this stop you from using Cursor
Yes - Cursor is unusable