No way to detect or prompt for ambient MCP “needs approval” (silent skip)

Ideas Feature Requests
,
1

We’re embedding local Cursor agents (T3 Code) with settingSources so ambient MCP from ~/.cursor/mcp.json and project .cursor/mcp.json can load.

From the CLI, unapproved servers are explicit:

$ agent mcp list
neon: not loaded (needs approval)
…

After agent mcp enable <server>, they become ready and show up in the agent tool catalog.

Through the SDK, the same unapproved servers just never appear. There is no public API/event/callback that says “this MCP exists but needs approval.” Internally the runtime throws something like McpServerNotApprovedError during lease load and skips the server. From an embedder’s point of view that is indistinguishable from “not configured,” “auth failed,” “disabled,” or “wrong cwd.”

So hosts cannot:

  1. Show a confirmation UI for MCP approval
  2. Tell the user why tools are missing
  3. Point them at agent mcp enable / the right project slug

agent.reload() also doesn’t help with discovery of this state.

Related (same area, separate ask)

Project ambient MCP appears tied to cwd-derived projectRoot, not local.dirs. For git worktree workflows (cwd = worktree, project .cursor/mcp.json only at the main workspace root), project MCPs don’t load even when dirs: [workspaceRoot] is set and settingSources includes “project”. Rules/skills from extra dirs seem to load; MCP does not. Happy to split that into a second thread if useful.

Expected Behavior

Some first-class SDK surface for ambient MCP lifecycle, for example:

  1. List configured ambient servers with status: ready | needs_approval | requires_authentication | disabled | error (+ message)
  2. A run/init event or host callback when a server is skipped for approval (don’t fail the whole run; just make it observable)
  3. Ideally a way to approve/deny from the host, or a documented “open CLI / deep link” path if approval must stay out-of-process

Also worth documenting next to settingSources in the MCP docs: approval is a hard gate, and the SDK will not prompt.

Steps to Reproduce

  1. Add an ambient stdio/HTTP server to ~/.cursor/mcp.json or /.cursor/mcp.json that is not in ~/.cursor/projects//mcp-approvals.json
  2. Confirm agent mcp list (from that cwd) shows not loaded (needs approval)
  3. Agent.create({ local: { cwd, settingSources: [“project”, “user”, “plugins”] }, … }) and run a turn
  4. Observe: server tools absent; no SDK signal that approval was the reason
  5. agent mcp enable <server>, restart/recreate agent → tools appear

Version Information

  • @cursor/sdk 1.2.0
  • Node 24
  • Local agents via Agent.create / agent.send
  • Linux

Additional context

We’re fine keeping approval as a Cursor-local trust gate. We just need the SDK to expose the same status the CLI already knows, so product UIs aren’t forced to shell out to agent mcp list or reverse-engineer mcp-approvals.json hashes.

5

I couldn’t find MCP approval mentioned in the SDK docs either, so the docs request is fair. The closest lines are “there’s no human-in-the-loop prompt in headless mode” and that custom tools “skip interactive approval”.

Two workarounds, both untested:

  1. Detect it on the host side. The stream emits a “system” init event, “Emitted once at the start of a run”, with a tools field. Compare that list with the server names in ~/.cursor/mcp.json and .cursor/mcp.json, and flag any configured server that contributed no tools, with a hint to run agent mcp enable. Limit: it can’t tell needs-approval apart from an auth failure.

  2. Pass the servers inline with mcpServers on Agent.create(). The documented load order is “Send > create > plugins > project > user (local)”. I don’t know whether inline servers skip the approval gate, so worth a quick test.

For CI, there is also agent --approve-mcps in the CLI docs, and agent mcp enable “adds the server to the local approved list”.

One more gap to plan for: “If a local MCP server requires OAuth login, the SDK can’t prompt you to sign in.”