Plugin MCP OAuth never reaches needsAuth — Authenticate button missing, browser never opens

Support Bug Reports
, ,
8

Follow-up: I applied the initialize-401 workaround on our MCP server, but I still cannot load the plugin in Cursor, so I cannot confirm Needs Authentication in the UI yet. The current blocker is GitHub marketplace import in Cursor IDE 3.18.9 Glass on macOS. This looks like a Cursor import bug, not the MCP server.

Attempt 1 — full HTTPS URL (rejected immediately; UI stays on Importing…)

Plugins → + Add → From GitHub Repository, scope User:

https://github.com/varsity-tech-product/quandora-plugins-staging

aiserver.v1.DashboardService.AddMarketplace returns:

ERROR_BAD_REQUEST / invalid_argument: Invalid URL format. Expected: github.com/owner/repo or gitlab.com/namespace/repo

The Import Marketplace dialog stays on Importing… and never shows that error. Cancel is disabled while Importing. /add-plugin with the same HTTPS URL is silent for the same reason.

Attempt 2 — scheme-less URL the API asked for (never completes)

Same dialog, same User scope:

github.com/varsity-tech-product/quandora-plugins-staging

This matches the documented format. There is no second AddMarketplace success or error in logs. The dialog stays on Importing… with Cancel disabled. No timeout.

Client behavior (3.18.9 glass)

The import form sets a busy flag, disables Cancel, and only clears busy in catch. Success is supposed to close the modal. If AddMarketplace hangs, the user is stuck. ConnectError.message is often just Error, so even a fast rejection is easy to miss.

Please:

  1. Surface AddMarketplace invalid_argument in the dialog and re-enable Cancel.
  2. Accept https://github.com/owner/repo (and .git) as well as github.com/owner/repo.
  3. Put a timeout on AddMarketplace and fail visibly.

The repo itself is valid (.cursor-plugin/marketplace.json is present; a local clone works). This is separate from the MCP OAuth host-allowlist issue. Privacy Mode (Legacy) is also on in this session; other DashboardService RPCs fail with “Cloud agent is not supported in Privacy Mode (Legacy).” Unclear if that affects the AddMarketplace clone path, but GitHub import is the call that hangs; local-folder import does not use AddMarketplace.