Cursor MCP: How to Add, Test, and Control MCP Servers

Add a Local stdio Server

A stdio server is a command that Cursor launches and talks to over standard input and output. Playwright MCP gives the agent a real browser, which makes it a practical first server for testing work:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["-y", "@playwright/mcp@latest", "--headless"]
    }
  }
}

The key, playwright here, becomes the server name in approvals, hooks and CLI commands, so keep it short and stable. Pin an exact version, such as @playwright/mcp@0.0.84, when every teammate's agent should see the same tools.

Add a Remote Server With OAuth

A remote server needs only a url. TestMu AI's MCP server connects Cursor to HyperExecute jobs, automation and native app test runs, SmartUI comparisons, accessibility checks and Test Manager through one endpoint, added next to the local entry:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["-y", "@playwright/mcp@latest", "--headless"]
    },
    "mcp-lambdatest": {
      "url": "https://mcp.lambdatest.com/mcp"
    }
  }
}

On first use, Cursor opens a browser sign-in. It finds the authorization server through the server's protected resource metadata (RFC 9728) and signs in with the authorization code flow and PKCE. You can read that metadata yourself before you trust a server:

curl -s https://mcp.lambdatest.com/.well-known/oauth-protected-resource
{"authorization_servers":["https://auth.lambdatest.com"],"bearer_methods_supported":["header"],"resource":"https://mcp.lambdatest.com/mcp"}

Some providers need a fixed client ID or a registered redirect URL instead. For those, add an auth object with CLIENT_ID, an optional CLIENT_SECRET and scopes to the server entry, and register the desktop app's callback, http://localhost:8787/callback, with the provider.

Keep Secrets Out of mcp.json

Cursor resolves variables in the command, args, env, url and headers fields, so a committed file can reference a secret without containing it. ${env:NAME} reads an environment variable, ${workspaceFolder} is the folder that holds .cursor/mcp.json, and envFile loads a .env file for stdio servers only.

The same pattern moves Playwright MCP's browser off your laptop. Its --cdp-endpoint flag accepts the CDP endpoint described in TestMu AI's Puppeteer testing docs, so each session runs on a cloud Chrome instead of a local one:

{
  "mcpServers": {
    "playwright-cloud": {
      "command": "npx",
      "args": ["-y", "@playwright/mcp@latest", "--cdp-endpoint", "${env:TESTMU_CDP_ENDPOINT}"]
    }
  }
}

Build the endpoint once from your TestMu AI username and access key, then restart Cursor so the servers it starts can see the variable:

export TESTMU_CDP_ENDPOINT="$(node -e '
const caps = {
  browserName: "Chrome",
  browserVersion: "latest",
  "LT:Options": {
    platform: "Windows 11",
    build: "Cursor MCP",
    name: "Playwright MCP session",
    user: process.env.LT_USERNAME,
    accessKey: process.env.LT_ACCESS_KEY
  }
};
console.log("wss://cdp.lambdatest.com/puppeteer?capabilities=" + encodeURIComponent(JSON.stringify(caps)));
')"

Write an Allowlist in permissions.json

The permissions.json reference describes an mcpAllowlist of server:tool entries in ~/.cursor/permissions.json or the repository's .cursor/permissions.json. Globs work inside names, and a file that sets mcpAllowlist replaces the allowlist in Cursor Settings, while a team admin's dashboard allowlist outranks both.

Start from the tool annotations. Playwright MCP marks 7 of its 25 tools read-only and the other 18 destructive, browser_navigate and browser_hover included. A glob such as playwright:browser_* would therefore also approve browser_run_code_unsafe, so name the read-only tools one by one:

{
  "mcpAllowlist": [
    "playwright:browser_snapshot",
    "playwright:browser_take_screenshot",
    "playwright:browser_console_messages",
    "playwright:browser_network_request*",
    "playwright:browser_find",
    "playwright:browser_wait_for",
    "mcp-lambdatest:list*",
    "mcp-lambdatest:getAutomationTest*",
    "mcp-lambdatest:getSession*",
    "mcp-lambdatest:getHyperExecute*",
    "mcp-lambdatest:tm_get_*",
    "mcp-lambdatest:tm_list_*"
  ],
  "autoRun": {
    "allow_instructions": [
      "Playwright navigation, clicks and typing on localhost or the TestMu AI Selenium Playground are test actions."
    ],
    "block_instructions": [
      "Ask before any mcp-lambdatest tool that deletes, stops, approves, rejects or uploads."
    ]
  }
}

Every tool the mcp-lambdatest patterns match carries the server's read-only annotation, so delete, stop and update tools stay off the allowlist, and the block_instructions entry steers the classifier to ask before them. The server's own instructions to the agent say the same: "Tools that delete, stop, approve, reject or upload change the account; confirm with the user before calling them."

The autoRun lists only steer the Auto-review classifier. The reference says to "treat both as steering, not enforcement": a call matching allow_instructions still goes through the safety check, and the lists do nothing in Allowlist mode.

Set the Same Rules in the Cursor CLI

The Cursor CLI keeps its own permissions in ~/.cursor/cli-config.json or the project's .cursor/cli.json, written as Mcp(server:tool) tokens under allow and deny:

{
  "permissions": {
    "allow": [
      "Mcp(playwright:browser_snapshot)",
      "Mcp(playwright:browser_take_screenshot)",
      "Mcp(playwright:browser_console_messages)"
    ],
    "deny": [
      "Mcp(playwright:browser_run_code_unsafe)",
      "Mcp(playwright:browser_evaluate)"
    ]
  }
}

Keep --approve-mcps out of shared scripts, because that flag approves every configured MCP server for the run. To take one server out of the CLI without editing mcp.json, run agent mcp disable with its name.

Add a Hook That Fails Closed

The allowlist only decides which tools skip the prompt. To refuse a call outright, add a beforeMCPExecution hook.

Cursor's hooks reference says the hook receives the tool name, its arguments and the server's key from mcp.json. Cursor runs every matching hook and merges their responses, so any deny wins over ask and ask wins over allow.

// .cursor/hooks.json
{
  "version": 1,
  "hooks": {
    "beforeMCPExecution": [
      { "command": "node .cursor/hooks/mcp-guard.js", "failClosed": true }
    ]
  }
}

// .cursor/hooks/mcp-guard.js
const KNOWN_SERVERS = ["playwright", "mcp-lambdatest"];
const BLOCKED_TOOLS = ["browser_run_code_unsafe", "browser_evaluate"];

let raw = "";
process.stdin.on("data", (chunk) => (raw += chunk));
process.stdin.on("end", () => {
  const call = JSON.parse(raw);
  let decision = { permission: "allow" };
  if (!KNOWN_SERVERS.includes(call.mcp_server_name)) {
    decision = { permission: "deny", user_message: `MCP server "${call.mcp_server_name}" is not on the project list.` };
  } else if (BLOCKED_TOOLS.includes(call.tool_name)) {
    decision = {
      permission: "deny",
      user_message: `${call.tool_name} runs arbitrary code and is blocked in this repo.`,
      agent_message: "Use browser_snapshot, browser_click or browser_type instead."
    };
  }
  console.log(JSON.stringify(decision));
});

Pipe sample calls into the script to see both outcomes before Cursor ever runs it:

$ echo '{"tool_name":"browser_run_code_unsafe","mcp_server_name":"playwright"}' | node .cursor/hooks/mcp-guard.js
{"permission":"deny","user_message":"browser_run_code_unsafe runs arbitrary code and is blocked in this repo.","agent_message":"Use browser_snapshot, browser_click or browser_type instead."}

$ echo '{"tool_name":"browser_snapshot","mcp_server_name":"playwright"}' | node .cursor/hooks/mcp-guard.js
{"permission":"allow"}

• failClosed - Fed input that is not JSON, the script exits with code 1. Without failClosed, Cursor treats that crash as a failed hook and lets the call through.
• Unknown servers - Any mcp_server_name outside KNOWN_SERVERS gets a deny, which follows the reference's advice to treat a missing or unexpected server name as a deny.
• Project path - Project hooks run from the repository root, so the command uses .cursor/hooks/ rather than ./hooks/.

Server-side limits are the last layer, and the Exposed by Design preprint shows they cannot be assumed on remote servers:

• Missing OAuth - 91.8% of the 414 internet-facing servers it tested dynamically had no OAuth authentication.
• Unguarded shell tools - 687 tool instances across confirmed servers exposed shell execution without access controls.
• Short-lived deployments - 41.6% of confirmed servers disappeared within three days between measurement runs.

For local servers you control, Playwright MCP's --allowed-origins and --blocked-origins flags narrow where its browser goes, though its own help text says they are not a security boundary and do not affect redirects. The wider threat model is in MCP security.