Why MCP with windows authentication is working fine now

Support Help
,
1

Subject: MCP + Windows Authentication (NTLM) — Connection prompt resolved without clear cause

Observed Behavior: On June 3, 2026, opening Cursor revealed a “Needs authentication” state in the MCP server panel, displaying a Connect button for my locally hosted MCP server. This server relies on Windows Authentication (NTLM/Negotiate) hosted via IIS Express (no OAuth or Bearer tokens). To bypass this, I temporarily modified the code to allow anonymous access.

Current Status: Today, after reverting the code back to enforce Windows Authentication, the connection is working silently and flawlessly.

Question/Issue: Why is it working now? I am unable to find anything in the Cursor changelogs indicating a fix for this behavior.

6

Hi Mohan!

Short version: nothing changed on Cursor’s side, and there’s no changelog entry because there was no fix to ship.

Cursor’s MCP client doesn’t perform a Windows Integrated Authentication (NTLM/Negotiate) handshake itself. For remote (HTTP/SSE) servers it only supports OAuth or a static auth header that you provide.

When it instead works silently, the NTLM/Negotiate negotiation is happening down at the OS and network layer, outside of Cursor. That means it depends on things like your Windows credential cache, localhost loopback behavior, and the IIS Express app-pool state. Toggling your site between Anonymous and Windows Auth recycles the app pool and resets that handshake state, which is the most likely reason the behavior flipped between June 3 and today. Since it lives outside Cursor, it isn’t guaranteed to stay consistent.

If you’d like a setup that’s reliable rather than dependent on that handshake state, use an auth method the MCP client supports directly:

  • Anonymous on a trusted localhost binding (you already saw this work when you allowed anonymous access)
  • A static token, if your server can accept an API key or Bearer. Set it as an Authorization header in your mcp.json:
{
"mcpServers": {
"your-server": {
"url": "http://localhost:PORT/mcp",
"headers": { "Authorization": "Bearer ${env:YOUR_TOKEN}" }
}
}
}
  • OAuth, if you can put an OAuth-capable endpoint in front of it

Config reference: Model Context Protocol.