Cursor
Cursor's own table lists all three transports with no deprecation note on SSE, and marks the two HTTP transports as OAuth-capable. Variable interpolation works in the command, arguments, environment, URL, headers, and auth fields.
- Client type
- Editor
- Protocol revision
- Not published
Support
Cursor
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Unknown
- Client ID
- Yes
- resource
- Unknown
- iss
- Unknown
- Headers
- Partial
- Protocol revision
- Not published. Cursor is closed source, and neither its documentation nor its changelog states a revision.
Caveats and sources
Each one names the column it qualifies and cites the page it comes from, which is often not the page in the row's primary source.
- Custom headers
- Configured headers are ignored against any server that answers OAuth discovery, because Cursor starts the OAuth flow before it sends the request carrying your header. Cursor staff confirmed this as a bug in March 2026, reported it still reproducible in May 2026, and noted the internal ticket closed without a fix. Source
- Tool and prompt updates
- Cursor staff describe list-changed notifications for tools, prompts, and resources as a known limitation: the subcapabilities aren't fully supported even when a server declares them. Source
- Tool caps
- A 40-tool cap is widely repeated for Cursor and isn't in any current documentation — it traces to 2025 forum threads. This page publishes no cap for Cursor for that reason. Source
Primary source
This row was last verified July 31, 2026 against the 2026-07-28 revision.