Hey, thanks for the detailed report. This isn’t a Cursor-side bug. Cursor returns the cursor://anysphere.cursor-mcp/oauth/callback redirect correctly, and OAuth works fine for other MCP providers that have this URI registered.
The “The app redirect URL is invalid” error is coming from Vercel’s authorize endpoint before the callback ever returns to Cursor. This means Vercel hasn’t whitelisted cursor://anysphere.cursor-mcp/oauth/callback as a valid redirect URI in their OAuth client config for the MCP integration client_id=cl_KcWL599JrCOhI4n2lXPJJ8rkF4SqSbOf. Redirect URI registration is done on the provider side, so we can’t fix this unilaterally.
I’ve reported this on our side. It also helps to ping Vercel support with the same request. The more signals they get, the faster they’ll pick it up. I can’t share an ETA since the fix depends on them. If there’s an update, I’ll post it in the thread.