Cursor

Cursor supports static OAuth for remote MCP servers via the auth object in mcp.json.

Before you start, ask Novaplan Support to confirm the approved OAuth app, Client ID, and Client Secret for your workspace.

For coding-agent access and the approved MCP setup, contact Novaplan Support.

Configuration

Open Cursor Settings > Tools and Integrations > New MCP Server, or edit your project’s .cursor/mcp.json:

{
  "mcpServers": {
    "novaplan": {
      "url": "NOVAPLAN_WORKSPACE_URL/mcp",
      "auth": {
        "CLIENT_ID": "YOUR_CLIENT_ID",
        "CLIENT_SECRET": "YOUR_CLIENT_SECRET",
        "scopes": [
          "openid", "profile", "email", "offline_access",
          "semantic:write",
          "conversation:write", "conversation:chat",
          "kb:read", "team:read", "user:read", "config:read"
        ]
      }
    }
  }
}

Cursor discovers the OAuth endpoints from Novaplan AI’s metadata.

If scopes is omitted, Cursor’s current documentation says it reads scopes_supported from /.well-known/oauth-authorization-server. To limit access, list only the scopes approved for the tools you need. Ask Novaplan Support to confirm the server-side defaults for your workspace.

Using Environment Variables

Use Cursor’s ${env:VAR} interpolation to keep secrets out of config files:

{
  "mcpServers": {
    "novaplan": {
      "url": "${env:NOVAPLAN_WORKSPACE_URL}/mcp",
      "auth": {
        "CLIENT_ID": "${env:NOVAPLAN_CLIENT_ID}",
        "CLIENT_SECRET": "${env:NOVAPLAN_CLIENT_SECRET}",
        "scopes": [
          "openid", "profile", "email", "offline_access",
          "semantic:write",
          "conversation:write", "conversation:chat",
          "kb:read", "team:read", "user:read", "config:read"
        ]
      }
    }
  }
}

Redirect URIs

Cursor surface	Redirect URI
Desktop app (current)	`http://localhost:8787/callback`
Desktop app (older installations)	`cursor://anysphere.cursor-mcp/oauth/callback`
Web and Cursor Agents	`https://www.cursor.com/agents/mcp/oauth/callback`

Cursor’s current MCP documentation lists the localhost callback for the desktop app and the HTTPS callback for web/agents. Some older desktop installations still use the cursor:// callback. The accessible Novaplan OAuth source accepts that legacy URI as well as localhost and HTTPS redirects, but the deployed Enterprise app still needs a sign-in test. A redirect mismatch means the exact URI sent by Cursor is not registered; check the authorization request before changing the OAuth app. If Cursor’s internal browser fails to load the OAuth login page, copy the authorization URL from the internal browser and paste it into your normal browser to complete the login flow.

Welcome To Novaplan AI

System Overview

Administration

Authentication

AI Providers

Connectors

Integrations

Agents

Toolsets

MCP Server

Developer

Additional Resources

Configuration

Using Environment Variables

Redirect URIs

​Configuration

​Using Environment Variables

​Redirect URIs

​OAuth Login Troubleshooting

Configuration

Using Environment Variables

Redirect URIs

OAuth Login Troubleshooting