Cloud Agents / Cursor MCP OAuth fails: “The app redirect URL is invalid”

Summary

Authenticating the official Vercel MCP (https://mcp.vercel.com) from Cursor Cloud Agents fails immediately on Vercel’s authorize page with:

The app redirect URL is invalid, please contact the app developer for support.

This happens before any consent screen. Cursor is sending a Cloud Agents callback URL that does not appear to be allowlisted on the Vercel MCP OAuth client.

Environment

• Client: Cursor Cloud Agents (web UI: + → MCP → Vercel connect/login)
• MCP server: https://mcp.vercel.com (as shipped in vercel-plugin .mcp.json)
• Date observed: 2026-07-23

Steps to reproduce

1. Open a Cursor Cloud Agent session with the Vercel MCP configured (via vercel-plugin or direct https://mcp.vercel.com).
2. In the agent UI, go to MCP settings and click connect / login for Vercel.
3. Browser opens Vercel OAuth authorize URL.
4. Page shows: “The app redirect URL is invalid”.

Expected

Vercel accepts the Cloud Agents callback, shows the consent screen, and completes OAuth so the Vercel MCP becomes usable in Cloud Agents (serverStatus: ready).

Actual

Vercel rejects the authorize request with “The app redirect URL is invalid”. In the Cloud Agent session, Vercel MCP stays needsAuth with no tools available.

Analysis

Cursor Cloud Agents / Automations use a different OAuth redirect than the desktop IDE:

The failure occurs on Vercel’s authorize endpoint before the callback returns to Cursor, which strongly indicates the Cloud Agents HTTPS callback is not registered on OAuth client cl_eD921KDq5R4BhfW5pRKJ6KHgY7d0JycM.

This matches the same pattern Cursor staff described for other MCP providers (e.g. Linear): desktop can work once its URI is allowlisted, while Cloud Agents fail until the provider adds https://www.cursor.com/agents/mcp/oauth/callback.

Start with the Vercel MCP entry in the shipped .mcp.json and the OAuth authorize request described in the issue; compare its redirect_uri with the Cursor Cloud Agents callback and the Vercel OAuth client configuration. Done means the authorize flow reaches consent, completes OAuth, and the Cloud Agent reports serverStatus: ready with tools available.