fix(server): preserve ambient Cursor MCP servers

[aravhawk]

Cursor send-level mcpServers replaces the workspace MCP configuration, hiding user, project, and plugin servers. Fixes #15268.

Keep the injected T3 server on agent creation/resume and omit MCP configuration from sends. Credential changes already reopen Cursor through the session manager, so this needs no additional agent cache or replacement logic. Updated to the current provider package layout.

Regression coverage adds an assertion to the existing adapter lifecycle test. Restoring the send override makes that assertion fail. No new test files or cases.

Validation: 18 tests pass in adapter.test.ts and CursorAgentSdk.test.ts; targeted lint, formatting, and the Cursor package typecheck pass. Separate simplification and adversarial reviews found no blockers, including after checking SDK 1.0.35. Live authenticated MCP discovery was not rerun.

Model and harness: GPT-6.1 Sol via Codex.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a focused Cursor adapter fix with comprehensive lifecycle tests, but it changes the handling and refresh lifecycle of thread-scoped MCP bearer credentials. Human review is warranted to validate the authenticated session behavior and credential exposure implications.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4c666c58-93a4-4963-9d82-f736ee470d7f

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between f0d23ff and 18cc3ba.

---

---

📒 Files selected for processing (2)

• packages/provider-cursor/src/server/adapter.test.ts
• packages/provider-cursor/src/server/adapter.ts

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

The Cursor adapter no longer passes the thread’s MCP server configuration with each send. A lifecycle test verifies that the send input omits mcpServers.

Changes

Cursor MCP send options

Layer / File(s)	Summary
Remove per-send MCP server override packages/provider-cursor/src/server/adapter.ts, packages/provider-cursor/src/server/adapter.test.ts	startTurn sends the selected model and interaction mode without mcpServers. The lifecycle test registers MCP configuration and asserts that send input does not have its own mcpServers property.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: juliusmarminge

---

---

Merge Risk: ⚪ Minimal · up to 18cc3

The change keeps MCP configuration at agent creation and removes the per-send override. The supplied lifecycle evidence identifies no active-session update path that would leave the agent with stale MCP settings; no actionable merge blocker remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 18cc3

The change restores already configured MCP servers while retaining existing sandbox and approval settings. No concrete security regression was established, but runtime configuration merging and effective permissions were not independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The intended effective exposure expands from the injected server override to ambient configured tools within the affected Cursor session. Their authority depends on the configured servers and runtime enforcement; the available evidence does not bound their external assets or credentials.

Trust Boundaries and Controls

• inferred — Control over enabled project or plugin configuration is relevant to the tools an agent may discover after this change. Existing sandbox and review-policy options are counterevidence to a direct policy bypass, but the mock regression proves option omission rather than tool execution containment or credential isolation.

Resilience and Maintainability Implications

• observed — The manager validates reused credential identity and capabilities, reserves credentials during preparation, and removes newly issued credentials on failed open or attachment while protecting other owners. These existing controls support session-lifetime MCP configuration and were not changed by this PR.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		#15268 requires Cursor threads to retain ambient user, project, and plugin MCP servers with t3-code. The adapter no longer sends mcpServers in agent.session.send; the existing agent creation and…
Out of Scope Changes check		The changes are limited to the Cursor adapter and its lifecycle regression test. Removing the send override directly addresses #15268. The test verifies the required behavior. No unrelated adapter, SD…
Title check		The title clearly and concisely describes the main change: preserving ambient Cursor MCP servers.
Description check		The description explains the problem, fix, scope, linked issue, verification results, limitations, and tooling used. It does not use the template headings or provide explicit maintainer approval evide…

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

---

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[nkoynov]

I verified this live on Linux: T3 server from source, @cursor/sdk 1.0.31, no SDK preload. I compared base a1d9d72a with this PR's head f0d23ff4.

~/.cursor/mcp.json registered one stdio server, p5-ping, whose tool p5_ping returns a marker and logs each call. Every turn on a Cursor composer-2.5 thread asked for fresh calls to p5_ping and to t3_thread_configuration:

Turn	base	this PR
1: new thread	p5_ping fails: MCP server does not exist: p5-ping. Available servers: t3-code; T3 tool OK	both OK
2: new T3 credential, same server process	p5-ping still missing; T3 tool OK	both OK
3: new T3 credential after a server restart	p5-ping still missing; T3 tool OK	both OK
4: plain follow-up	–	both OK; same SDK agent, no new p5-ping process

For turn 2 I rotated the credential by switching the runtime mode and back. Cursor can't switch runtime mode in-session, so that replaces the provider session. The PR's trace shows the old credential revoked, a new one issued with CursorAdapterV2.openSession, then a successful T3 tools/call. Neither branch logged rejected MCP request with an unusable credential.

Gap: the new reopen in openAgent when mcpServers changes (CursorAdapterV2.ts:2090) never ran. In every rotation I could trigger, the credential changed together with a fresh adapter runtime. I found no user action that rotates a Cursor thread's credential while its session stays open.

Not tested: project .cursor/mcp.json, plugin MCP servers, HTTP/OAuth servers, the 30-minute idle release, and macOS.

Model: Claude Opus 5.5 (1M). Harness: Claude Code in T3 Code.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Hi! We are cleaning up open PRs, and this one appears to have been created with an older model (gpt-6). If this change is really important, we recommend rebuilding the PR with a newer model if possible.

[TomaszJanusz]

Hey @maria-rcks @juliusmarminge, @t3dotgg would it be possible for you to take a look at this PR? It's fixes the annoying thing that appeared last time. Since a much wider #16466 has also been closed, maybe this point fix in Cursor's adapter could go to the main?

[TomaszJanusz]

@juliusmarminge you are my hero <3