Cursor send-level mcpServers replaces the workspace MCP configuration, hiding user, project, and plugin servers. Fixes #15268.
Keep the injected T3 server on agent creation/resume and omit MCP configuration from sends. Credential changes already reopen Cursor through the session manager, so this needs no additional agent cache or replacement logic. Updated to the current provider package layout.
Regression coverage adds an assertion to the existing adapter lifecycle test. Restoring the send override makes that assertion fail. No new test files or cases.
Validation: 18 tests pass in adapter.test.ts and CursorAgentSdk.test.ts; targeted lint, formatting, and the Cursor package typecheck pass. Separate simplification and adversarial reviews found no blockers, including after checking SDK 1.0.35. Live authenticated MCP discovery was not rerun.
Model and harness: GPT-6.1 Sol via Codex.
Added 1 commit
Verdict: Not approved
Macroscope's review found this PR not approvable — This is a focused Cursor adapter fix with comprehensive lifecycle tests, but it changes the handling and refresh lifecycle of thread-scoped MCP bearer credentials. Human review is warranted to validate the authenticated session behavior and credential exposure implications.
You can add or adjust custom eligibility rules. Learn more.
Added 1 commit
No actionable comments were generated in the recent review. 🎉
4c666c58-93a4-4963-9d82-f736ee470d7fReviewing files that changed from the base of the PR and between f0d23ff428a1cf89e861bca12aed5b7a3e8a609f and 18cc3ba0494c8034212699d74f2857b42e5a92a3.
packages/provider-cursor/src/server/adapter.test.tspackages/provider-cursor/src/server/adapter.tsIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
The Cursor adapter no longer passes the thread’s MCP server configuration with each send. A lifecycle test verifies that the send input omits mcpServers.
Cursor MCP send options
| Layer / File(s) | Summary |
|---|---|
Remove per-send MCP server override packages/provider-cursor/src/server/adapter.ts, packages/provider-cursor/src/server/adapter.test.ts | startTurn sends the selected model and interaction mode without mcpServers. The lifecycle test registers MCP configuration and asserts that send input does not have its own mcpServers property. |
Priority: ➖ Normal
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix · Severity of issue fixed: Medium
Suggested reviewers: juliusmarminge
Merge Risk: ⚪ Minimal · up to 18cc3
The change keeps MCP configuration at agent creation and removes the per-send override. The supplied lifecycle evidence identifies no active-session update path that would leave the agent with stale MCP settings; no actionable merge blocker remains.
Security architecture risk: 🔵 Low · up to 18cc3
The change restores already configured MCP servers while retaining existing sandbox and approval settings. No concrete security regression was established, but runtime configuration merging and effective permissions were not independently verified.
Retained concerns No architecture-level concerns identified.
Security Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
| Check name | Status | Explanation |
|---|---|---|
| Linked Issues check | Passed | #15268 requires Cursor threads to retain ambient user, project, and plugin MCP servers with t3-code. The adapter no longer sends mcpServers in agent.session.send; the existing agent creation and… |
| Out of Scope Changes check | Passed | The changes are limited to the Cursor adapter and its lifecycle regression test. Removing the send override directly addresses #15268. The test verifies the required behavior. No unrelated adapter, SD… |
| Title check | Passed | The title clearly and concisely describes the main change: preserving ambient Cursor MCP servers. |
| Description check | Passed | The description explains the problem, fix, scope, linked issue, verification results, limitations, and tooling used. It does not use the template headings or provide explicit maintainer approval evide… |
Comment @coderabbitai help to get the list of available commands.
I verified this live on Linux: T3 server from source, @cursor/sdk 1.0.31, no SDK preload. I compared base a1d9d72a with this PR's head f0d23ff4.
~/.cursor/mcp.json registered one stdio server, p5-ping, whose tool p5_ping returns a marker and logs each call. Every turn on a Cursor composer-2.5 thread asked for fresh calls to p5_ping and to t3_thread_configuration:
| Turn | base | this PR |
|---|---|---|
| 1: new thread | p5_ping fails: MCP server does not exist: p5-ping. Available servers: t3-code; T3 tool OK | both OK |
| 2: new T3 credential, same server process | p5-ping still missing; T3 tool OK | both OK |
| 3: new T3 credential after a server restart | p5-ping still missing; T3 tool OK | both OK |
| 4: plain follow-up | – | both OK; same SDK agent, no new p5-ping process |
For turn 2 I rotated the credential by switching the runtime mode and back. Cursor can't switch runtime mode in-session, so that replaces the provider session. The PR's trace shows the old credential revoked, a new one issued with CursorAdapterV2.openSession, then a successful T3 tools/call. Neither branch logged rejected MCP request with an unusable credential.
Gap: the new reopen in openAgent when mcpServers changes (CursorAdapterV2.ts:2090) never ran. In every rotation I could trigger, the credential changed together with a fresh adapter runtime. I found no user action that rotates a Cursor thread's credential while its session stays open.
Not tested: project .cursor/mcp.json, plugin MCP servers, HTTP/OAuth servers, the 30-minute idle release, and macOS.
Model: Claude Opus 5.5 (1M). Harness: Claude Code in T3 Code.
Note
Written by claude-opus-5-5 on behalf of Maria
Hi! We are cleaning up open PRs, and this one appears to have been created with an older model (gpt-6). If this change is really important, we recommend rebuilding the PR with a newer model if possible.
Hey @maria-rcks @juliusmarminge, @t3dotgg would it be possible for you to take a look at this PR? It's fixes the annoying thing that appeared last time. Since a much wider #16466 has also been closed, maybe this point fix in Cursor's adapter could go to the main?
Added 2 commits
@juliusmarminge you are my hero <3
