Remote MCP servers: run a command to get auth headers (like Claude Code’s headersHelper)

Ideas Feature Requests
1

Feature request for product/service

Cursor IDE

Describe the request

Our internal MCP server (Streamable HTTP) uses bearer tokens that expire after 24 hours. A token comes from a separate token endpoint with Basic auth, and the server has no OAuth. In mcp.json the only option is a static Authorization header, optionally filled from an environment variable with ${env:NAME}. So every day each user has to request a new token, update mcp.json or the variable, and reconnect. After the token expires, Cursor shows a misleading OAuth error instead of the 401 (bug report).

Request: let a remote server entry name a command that prints the request headers as a JSON object. Cursor would run it when it connects to the server, and again when a request gets a 401 or 403, then reconnect with the new headers and retry the request once.

{
  "mcpServers": {
    "internal": {
      "url": "https://mcp.example.com/mcp",
      "headersHelper": "/path/to/get-mcp-headers.sh"
    }
  }
}

Claude Code has this as headersHelper. It also passes the server’s name and URL to the command in environment variables, so one script can serve several servers. Using the same name and behavior would let one script work in both tools.

Our workaround is a local stdio MCP server that forwards to the remote one and adds the header. It works, but every team with this kind of server has to build and maintain one.

6

Hi @radmar,

There’s no headersHelper equivalent in Cursor today. A remote entry takes static headers (with ${env:NAME} interpolation), or an auth block for servers that use OAuth, and any other key is ignored. Headers are set when Cursor connects, so a 401 or 403 doesn’t fetch new ones. We already have an open request for command-based headers, and yours is the same ask!

For now, a local stdio proxy like yours is the most reliable option, since Cursor launches that command itself and it can fetch a fresh token whenever it needs one.

On the error: when a server answers 401, Cursor first tries OAuth discovery, which the MCP spec requires. A failed connect with a configured Authorization header should now show the HTTP 401 instead, but a token that expires in the middle of a session may still end in the OAuth error. If you see it when Cursor first connects, could you share the exact error text and your Cursor version?