Guides / Cursor

Cursor mcp.json API keys: keep secrets out of .cursor/mcp.json

Cursor's project file .cursor/mcp.json lists the MCP servers the agent can call. It has no allow/deny permission model (approvals live in Cursor's app settings, which aren't in the repo), so the main risk in the committed file is secrets.

Data snapshot: 2026-10-20. Counts are unique public GitHub configs, identical files counted once. Aggregates only; no repos are named.

What the settings in .cursor/mcp.json do

mcpServers.<name>.command / args: The local process Cursor starts for a stdio MCP server.
mcpServers.<name>.url: A remote MCP server reached over HTTP.
mcpServers.<name>.env: Environment for the server. This is where API keys end up hardcoded.
${env:NAME} interpolation: Cursor can read values from your environment, so the file never needs to contain the key itself.

What public Cursor configs look like

Unique public .cursor/mcp.json files analyzed	1,427
…with at least one credential-looking value	7.8%
…defining at least one MCP server	99.2%
Leaderboard	#4 of 4 on the safety leaderboard (score 92.2)

See the full dataset and leaderboard methodology. Public repos skew toward demos and templates, so treat these as a lower bound on what is possible, not a census.

Common risky patterns

API keys in env or headers
Anything committed to a public repo is scraped within minutes. Rotate the key, then switch to ${env:NAME}.
Unknown MCP servers via npx -y
npx -y runs the latest published version without review. Pin versions for servers you depend on.
Auto-run settings in the app
Cursor's auto-run/allowlist lives in app settings, not this file. The index can't see it, so check it yourself.

A safer starting config

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${env:GITHUB_TOKEN}"
      }
    }
  }
}

Adjust the allowed commands to your project. Rotate any key that was ever committed, even if you remove it later.

Grade your config

Paste your .cursor/mcp.json into the grader. It flags credential-looking values and nothing leaves your browser. Grading runs in your browser and the config is never stored. You get an A–F grade, the fixes, and a README badge.

Open the grader Grade from your agent (MCP)

Cursor permissions FAQ

Can I use environment variables in .cursor/mcp.json?

Yes. Cursor resolves ${env:NAME} in command, args, env, url and headers. Local (stdio) servers also accept envFile, e.g. "${workspaceFolder}/.env".

How many public Cursor mcp.json files contain a key?

7.8% of 1,427 unique public .cursor/mcp.json files contain at least one credential-looking value. The check is a heuristic and has false positives.

I committed a key in mcp.json. Is deleting it enough?

No. It stays in git history and may already have been scraped. Rotate the key first, then switch the file to ${env:NAME}.