Skip to content

Cloud Agents / Cursor MCP OAuth fails: “The app redirect URL is invalid” #127

Description

@thibautvdu

Summary

Authenticating the official Vercel MCP (https://mcp.vercel.com) from Cursor Cloud Agents fails immediately on Vercel’s authorize page with:

The app redirect URL is invalid, please contact the app developer for support.

This happens before any consent screen. Cursor is sending a Cloud Agents callback URL that does not appear to be allowlisted on the Vercel MCP OAuth client.

Environment

  • Client: Cursor Cloud Agents (web UI: + → MCP → Vercel connect/login)
  • MCP server: https://mcp.vercel.com (as shipped in vercel-plugin .mcp.json)
  • Date observed: 2026-07-23

Steps to reproduce

  1. Open a Cursor Cloud Agent session with the Vercel MCP configured (via vercel-plugin or direct https://mcp.vercel.com).
  2. In the agent UI, go to MCP settings and click connect / login for Vercel.
  3. Browser opens Vercel OAuth authorize URL.
  4. Page shows: “The app redirect URL is invalid”.

Expected

Vercel accepts the Cloud Agents callback, shows the consent screen, and completes OAuth so the Vercel MCP becomes usable in Cloud Agents (serverStatus: ready).

Actual

Vercel rejects the authorize request with “The app redirect URL is invalid”. In the Cloud Agent session, Vercel MCP stays needsAuth with no tools available.

Analysis

Cursor Cloud Agents / Automations use a different OAuth redirect than the desktop IDE:

Context Typical redirect_uri
Cursor desktop IDE cursor://anysphere.cursor-mcp/oauth/callback (or loopback http://localhost:8787/callback)
Cursor Cloud Agents https://www.cursor.com/agents/mcp/oauth/callback

The failure occurs on Vercel’s authorize endpoint before the callback returns to Cursor, which strongly indicates the Cloud Agents HTTPS callback is not registered on OAuth client cl_eD921KDq5R4BhfW5pRKJ6KHgY7d0JycM.

This matches the same pattern Cursor staff described for other MCP providers (e.g. Linear): desktop can work once its URI is allowlisted, while Cloud Agents fail until the provider adds https://www.cursor.com/agents/mcp/oauth/callback.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions