Cursor MCP setup: connect Invoke Human

One url field in mcp.json. Sign-in happens in Cursor. No API key in the file.

Updated October 17, 2026

1. Add the URL. Put invoke-human in mcp.json with the url https://invokehumantool.com/mcp. Use .cursor/mcp.json for one project or ~/.cursor/mcp.json for every project.
2. Skip the static OAuth block. Do not add an auth client id. Invoke Human publishes dynamic client registration, which is the case Cursor handles without static credentials.
3. Sign in when Cursor asks. Reload the window if the server does not appear, then finish the OAuth prompt. The scope is handoffs.
4. Call a handoff tool. Ask the agent to use send_handoff, send_ui_handoff, send_html_handoff, validate_ui, share_handoff, delegate_handoff, get_handoff_status, get_handoff_result, or wait_for_handoff, and answer in the Invoke Human app.

Cursor’s MCP docs describe three transports. Invoke Human is the third: streamable HTTP, a URL, OAuth. Nothing is installed on your machine to proxy it.

The file

Project servers live in .cursor/mcp.json. Servers for every project live in ~/.cursor/mcp.json. Cursor merges them. The project file wins on a name clash. This is the same block the home page and Support show:

{
  "mcpServers": {
    "invoke-human": {
      "url": "https://invokehumantool.com/mcp"
    }
  }
}

Do not add headers, and do not add an auth object. Cursor’s docs reserve auth (CLIENT_ID, optional CLIENT_SECRET, optional scopes) for a provider that will not register a client dynamically and wants a fixed client id. Invoke Human’s authorization server publishes registration_endpoint, PKCE S256, and the scope handoffs. Cursor discovers that from the well-known metadata and runs the browser login. The remote MCP guide is that metadata, fetched from the live server.

If you copied a snippet that puts a bearer token in headers, delete it. A personal access token is the fallback for servers that do not speak this OAuth flow. This one does.

You can also add it from Customize. Cursor’s docs say MCP servers are managed there, next to plugins and skills. The JSON is the version you can commit.

Sign in and call it

Reload the window after saving the file if the server does not show up. The first connection that needs a token opens the browser. Sign in with the email or Apple ID on the account.

Then ask the agent for a person. send_handoff sends a handoff to the signed-in person, or to other people. send_ui_handoff sends a structured form the person answers on a device or a signed link. send_html_handoff sends an HTML handoff the person answers by tapping or typing. validate_ui checks a UI document before it is sent. share_handoff invites more people to a handoff, or forwards it. delegate_handoff forwards a handoff to new recipients. get_handoff_status reads the type, title, and status of one handoff. get_handoff_result fetches the answer, or the current status if it is not finished. wait_for_handoff waits until the person finishes that handoff. Parameter names come from the tool list the server returns after OAuth. The short install is on Support.

Cursor already asks before it runs tools. That dialog stays. The handoff is a separate question that comes back through the Invoke Human app on iPhone, iPad, or Mac, and the answer is returned to the Cursor agent that asked. Several agents on one account is the multi-agent handoffs page.

iPhone and iPad: iOS 17 or later, TestFlight from the home page.

When it fails

Cursor documents fixed redirect URLs for providers that require you to register them yourself (https://www.cursor.com/agents/mcp/oauth/callback and http://localhost:8787/callback). You do not register those by hand for Invoke Human. Dynamic client registration is how the client tells the server its redirect.

Same server, other clients: Claude, Codex, ChatGPT.