---
title: "Cursor MCP Setup | Gazebo Docs"
description: "Add Gazebo to Cursor as an MCP server. Retrieve scoped credentials from your vault using the get_credential tool."
url: "https://gazebohq.com/docs/mcp/cursor"
---

Add Gazebo to Cursor as an MCP server so your agent can retrieve credentials from the vault using natural language tool calls.

## Prerequisites

- A Gazebo account with at least one service connected
- An agent created in Gazebo with a bearer token

## Configuration

Add the following to your Cursor MCP config file at `.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "gazebo": {
      "url": "https://app.gazebohq.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <your-agent-token>"
      }
    }
  }
}
```

Replace `<your-agent-token>` with the token from your agent's page in the Gazebo dashboard.

If `.cursor/mcp.json` doesn't exist yet, create it in your home directory or project root.

## Verify the connection

Ask Cursor to call `get_identity` — you should see your agent's name and connected services:

```
get_identity()
→ {
    status: "ok",
    name: "cursor-dev",
    accessible_services: [
      { service: "stripe", allowed_methods: ["GET", "POST"] }
    ]
  }
```

## Retrieve a credential

```
get_credential({ service: "stripe", method: "GET" })
→ "<scoped-service-credential>"
```

Cursor (or your agent inside Cursor) can now use this credential to make Stripe API calls.

## Handling denials

If `get_credential` returns a denial:

```json
{
  "status": "denied",
  "service": "stripe",
  "method": "DELETE",
  "allowed_methods": ["GET", "POST"],
  "reason": "...",
  "next_action": "..."
}
```

The agent does not have `DELETE` access for Stripe. Update the access profile in the Gazebo dashboard to add the method, or use a permitted method instead. Do not retry without changing the policy — the denial will repeat.

## Troubleshooting

**Cursor doesn't show Gazebo tools** — Check that `mcp.json` is valid JSON and that Cursor has restarted after the config change.

**`401 Unauthorized`** — The bearer token is invalid or the agent has been deleted. Verify the token in the Gazebo dashboard.

**`get_credential` returns `not_found`** — No credential is stored for that service. Connect the service in **Settings → Services**.