Cursor reads MCP servers out of a JSON file. Most guides then spend a thousand words on how to run those servers — one process per integration, each with its own OAuth application and its own token to keep alive.
This is the version where you add one entry and stop.
The config
{
"mcpServers": {
"spinrun": {
"url": "https://spinrun.ai/mcp",
"headers": {
"x-spinrun-client": "cursor"
}
}
}
}Restart Cursor. There is no key in that block on purpose: Cursor opens a browser the first time it connects, you choose a workspace there, and the tools appear.
If you would rather not hand-edit JSON, spinrun install cursor merges the same
block into the same file — the CLI and this page are generated from one
definition, so they cannot disagree about what a working configuration looks
like.
The one header
x-spinrun-client carries no secret at all. It tells the activity log which
client made a call, which is what lets you answer "was that me in Cursor or the
scheduled job?" without guessing. Nothing else needs to be in that block: Cursor
authorizes in the browser, and the tools it then sees are the connections you
can see, because it is acting as you.
What Cursor gets
Every tool your workspace has connected, named TOOLKIT_VERB_OBJECT:
GITHUB_CREATE_ISSUE, SLACK_SEND_MESSAGE, NOTION_CREATE_PAGE. Cursor lists
them under the server name you registered, and you can call them from the agent
pane like any other tool.
The interesting part is not any single tool. It is that Cursor already has the code and now also has the context around the code — the issue that describes the bug, the thread where someone reported it, the CRM record of the customer who hit it.
Set the rules before you open the door
Cursor is an editor with an agent in it, and the agent is about to be able to
write to systems that are not version-controlled. A bad edit in a repository is a
git checkout away from being undone. A deleted CRM record is not.
Set each connected app's policy first — read, write and destructive, each allowed or blocked. Blocking destructive across the board takes about a minute, and you can relax it for the one app where you have a reason to.
Two accounts, one editor
Connect the same app twice — a work Slack and a community Slack, two GitHub
accounts — and each connection keeps its own credential. Their tools are
addressed apart with a suffix: SLACK_SEND_MESSAGE__work and
SLACK_SEND_MESSAGE__community.
The bare name still routes to your default connection, so this never breaks a configuration that was working before you added the second account. And the suffix is routing only: permissions and the activity log key on the underlying tool, so a rule you set applies to both.
When the tool list gets long
Every tool definition costs context on every request. Past a certain number of connected apps that becomes the dominant cost of having them connected at all.
Compact mode is the answer: the gateway stops sending the full list and offers search instead, so Cursor looks up a tool when it needs one. Searching and reading schemas are both free, deliberately — the cheap path has to stay cheaper than guessing or nobody takes it.
Next
- VS Code MCP setup — nearly the same file, one important difference
- Agent permissions belong at the gateway
- The toolkit catalogue