Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
A header‑authenticated (non‑OAuth) remote Streamable‑HTTP MCP server cannot be connected by URL when Cursor is attached to a Remote‑SSH host. The connection fails during OAuth discovery with Invalid URL protocol: the URL must start with http: or https: — and it fails before the client ever sends a request to the server. The offending URL is not my configured URL (which is a valid http://…); it is a URL the client derives internally during the OAuth flow. The exact same server URL works in VSCode and works with a raw fetch() from Cursor’s own bundled Node, so the server, network, headers, and config are all correct — only Cursor’s remote MCP client fails.
Steps to Reproduce
Connect Cursor to a Linux host via Remote‑SSH.
In the remote ~/.cursor/mcp.json, add a remote Streamable‑HTTP MCP server that uses header auth (no OAuth):
{ “mcpServers”: { “myserver”: {
“url”: “http://:8765/mcp”,
}
}}}
Reload MCP (Settings → Tools & MCP).
Observe the connection fail. MCP client log:
[V2 FSM] connection:connect_start: conn=idle,auth=unknown → conn=connecting,auth=unknown
MCP OAuth provider initialized
Cancelling MCP OAuth authorization flow
MCP HTTP exchange failed
Transient error connecting to streamableHttp server: Invalid URL protocol: the URL must start with http: or https:.
Connection failed: Invalid URL protocol: the URL must start with http: or https:.
[V2 FSM] connection:connect_failure: conn=connecting,auth=unknown → conn=failed,auth=unknown
CreateClient completed, connected: false, statusType: error
Evidence it is client‑side, not server/network/config (all reproducible):
The identical URL connects fine in VSCode’s MCP client over the same Remote‑SSH host.
A raw fetch() to the URL run with Cursor’s own bundled Node (~/.cursor-server/…/node, v20.18.2) returns HTTP 200 with a valid JSON‑RPC response.
Server access logs show zero requests from the client at the failure moment, and no /.well-known/oauth-* probe is ever received → the client throws while constructing a URL before sending anything.
Server behavior is spec‑correct: POST /mcp initialize → 200 application/json; GET /mcp → 405; no redirect / Location / WWW-Authenticate. Adding empty‑body 404 on .well-known/oauth-*, an Mcp-Session-Id header, and 405 on GET made no difference (because no request reaches the server).
Expected Behavior
For a remote HTTP MCP server that does not advertise OAuth and has headers configured, the client should connect and authenticate using those headers. OAuth discovery should be skipped (or the derived‑URL construction guarded) instead of throwing Invalid URL protocol and aborting before any network request.
Operating System
Windows 10/11
Version Information
Version: 3.5.33 (user setup)
VSCode Version: 1.105.1
Commit: aac81804b986d739acab348ed96b8bea6e83cc50
Date: 2026-05-22T06:47:48.039Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Windows_NT x64 10.0.26100
Does this stop you from using Cursor
No - Cursor works, but with this issue