# idealo MCP auth proxy

A small local [stdio](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#stdio) bridge so [Cursor](https://cursor.com) can use the official [idealo MCP server](https://github.com/idealo/mcp-server-guide) while Idealo's OAuth allowlist does not yet include Cursor's current redirect URI.

The same pattern applies to any remote MCP that uses OAuth + Dynamic Client Registration against a strict identity provider (AWS Cognito, Okta, Auth0, …) that only allowlists a subset of client callbacks.

## Why this proxy exists

Cursor can talk to remote MCP servers over HTTP and run the OAuth handshake itself. That used to work with idealo.

Cursor then changed the desktop MCP callback from a custom scheme to an RFC 8252 loopback URL:

| Surface | Redirect URI |
| --- | --- |
| Older Cursor desktop | `cursor://anysphere.cursor-mcp/oauth/callback` |
| Current Cursor desktop | `http://localhost:8787/callback` |
| Cursor web / agents | `https://www.cursor.com/agents/mcp/oauth/callback` |

See the [Cursor MCP docs](https://cursor.com/docs/mcp) (`http://localhost:8787/callback` for desktop). There is no `mcp.json` field to pick a different redirect URI.

idealo fronts Cognito and exposes Dynamic Client Registration at `https://mcp.idealo.com/oauth2/register`. Registration does **not** create a new Cognito app per client. Every successful registration is mapped onto one shared Cognito client. Only redirect URIs on that client's allowlist work. As of September 2026 that list includes Claude Code and the old Cursor custom scheme, but **not** the current Cursor loopback URL:

| Redirect URI | Idealo DCR / Cognito |
| --- | --- |
| `cursor://anysphere.cursor-mcp/oauth/callback` | allowed |
| `http://localhost:6274/callback` (Claude Code) | allowed |
| `https://claude.ai/api/mcp/auth_callback` | allowed |
| `https://vscode.dev/redirect` | allowed |
| `http://localhost:8787/callback` | **rejected** (`invalid_redirect_uri` / `redirect_mismatch`) |
| `https://www.cursor.com/agents/mcp/oauth/callback` | **rejected** |

So Cursor opens Cognito with `redirect_uri=http://localhost:8787/callback`, Cognito answers `redirect_mismatch`, and the browser shows “Something went wrong”. Mapping `cursor://` to port 8787 does not help: Cursor never sends that URI anymore, so Cognito never redirects to it.

This repo does not try to change Cursor's redirect. It takes Cursor out of the OAuth path:

1. Cursor starts a **local stdio** process (no remote OAuth, no `:8787`).
2. That process is [`mcp-remote`](https://www.npmjs.com/package/mcp-remote).
3. `mcp-remote` registers and authorizes with the callback idealo already allowlists: `http://localhost:6274/callback`.
4. After login, it forwards MCP calls to `https://mcp.idealo.com/mcp` with the bearer token.

Once idealo allowlists Cursor's current callbacks, you can delete this proxy and put the remote URL back in `mcp.json`.

## Setup

```bash
git clone <this-repo> idealo-proxy
cd idealo-proxy
npm install
```

In `~/.cursor/mcp.json`, replace a remote `url` entry with a command that runs the wrapper (use your clone path):

```json
{
  "mcpServers": {
    "idealo": {
      "command": "node",
      "args": [
        "/absolute/path/to/idealo-proxy/bin/idealo-mcp.js"
      ]
    }
  }
}
```

Reload the idealo MCP server in Cursor. On first connect a browser window opens for idealo login. Tokens are cached under `~/.mcp-auth`.

## License

Copyright (c) 2026 Sebastian Schmittner

This project is released under the [MIT License](https://opensource.org/license/mit) (OSI-approved). The full text is in [LICENSE](./LICENSE):