What the names mean
| Cursor term | Meaning |
|---|---|
| MCP server | A direct local or remote capability that supplies tools and other supported MCP features. |
| Plugin | An installable Marketplace or team package that can bundle MCP servers with other agent customizations. |
| MCP App | An interactive UI returned by an MCP tool and displayed in a sandboxed agent-chat frame. |
| Extension API | A programmatic way for an editor extension to register an MCP server—not another name for the server itself. |
Local and remote setup
Local servers use stdio and are launched by Cursor. Remote servers use supported HTTP transports. Configuration can be project-scoped in .cursor/mcp.json or global in the user configuration. Cursor CLI can use MCP servers and provides commands to inspect connections and tools.
A project configuration can be shared with a team, but it should not contain secrets. Local commands are executable code on the developer’s machine; review the package, command, environment, and update behavior before trusting it.
Plugins are the distribution layer
Cursor packaging
Plugin → MCP server → tools/resources/prompts → optional MCP App interface
Installing a plugin may add more than a connection. Teams should inventory every capability it bundles, apply Marketplace and organization controls, and review which tools cloud agents may use as well as local agents.
Approvals and authentication
- Remote MCP can use OAuth; the exact callback and registration behavior varies between desktop, CLI, web, and agent surfaces.
- Local servers usually receive credentials from secure environment configuration rather than an interactive remote OAuth flow.
- Tool calls follow Cursor’s permission and run-mode controls. Auto-approval should be narrow, especially for shell, deployment, data-changing, or external-communication tools.
- Enterprise controls can restrict allowed servers, commands, URLs, networks, and tools.
Progressive tool exposure
Cursor’s January 2026 release notes state that MCP server definitions and tools live as JSON and agents discover and load MCPs only when needed. That reduces the catalog carried in the active context. This is a Cursor host behavior; an MCP server should still keep names and descriptions concise and test selection in other clients.
Good fit
Cursor is a strong target for development tools that need repository context, local commands, or remote engineering services. It is not a general business assistant, so a customer-facing MCP product should normally test a broader host in addition to Cursor.