MCP server setup in Cursor, Claude Code, and VS Code: a safe configuration path

After one call, open MCP Logs and check the command, environment expansion, and whether the server loaded once or more than once. Cursor lets you toggle a server in Customize without deleting it. That is useful for isolating a failure, but it does not replace a narrow permission design. Before sharing a configuration, remove local paths and tokens and keep only reproducible, non-sensitive fields.

Use Claude Code scopes and approvals deliberately

The official Claude Code MCP reference supports claude mcp add and JSON configuration in .mcp.json, user settings, or command arguments. It distinguishes local, project, and user installation scopes and documents workspace trust for project servers. Choose the narrowest scope that meets the task. A personal utility should not automatically become a repository-wide dependency.

For a remote HTTP entry, specify both type and url. The documentation warns that a URL without a type is treated as a stdio entry and skipped. Check /mcp or the status output after the first connection so you know which entry actually loaded. Keep approval prompts for file writes, network calls, and draft creation. A workflow that is slightly slower but exposes the target and arguments is easier to audit than a mode that skips permission prompts.

Add an MCP server in VS Code

VS Code’s official documentation puts MCP servers under Agent customization. You can add one from the command palette or use workspace configuration. Workspace scope is useful when a team wants a reviewed setup; user scope is useful for a personal utility. Either way, inspect the configuration before committing it. A repository should contain example values, not local paths, account identifiers, or secrets.

After adding a server, check the MCP list and run one no-side-effect query. If the process does not start, inspect the runtime version, PATH, workspace trust, and JSON syntax. The Agent permission surface and the server permission surface are separate boundaries. Seeing a tool in the list does not mean every call should run automatically.

Review trust, prompt injection, and credentials

Read the server’s source or official documentation before connecting it. You need to know which directories it reads, which domains it contacts, whether it forwards input to another provider, and which actions it can perform. Claude Code’s official MCP page explicitly warns that servers fetching external content can expose you to prompt injection. “It only provides context” is not a complete security review when the same server can also execute actions.

Split credentials by purpose. Give a read-only token to a read-only API, a write token only to the workflow that needs writes, and never share production credentials with a development workstation. Review database, storage, issue, and document permissions separately. Save one approval example and confirm that a human can see the target, parameters, and returned content. If a call looks suspicious, disable the server, rotate the credential, and then inspect logs.

Debug in dependency order and keep a rollback

Check that the client reads the configuration first, then run the process directly, then test authentication, and only then investigate a tool call. This order separates “never loaded” from “loaded and rejected.” Use Cursor MCP Logs, Claude Code status and failure output, and VS Code Agent output and server lists. A timeout is not automatically a protocol incompatibility.

For repeated remote timeouts, reduce the number of tools and inspect proxy, OAuth callback, and network policy. For a local exit, run the same command in a terminal and read stderr. Restore one server at a time. Keep a known-good configuration for rollback and remove temporary tokens and sensitive fragments from debug logs.

Does an MCP server have to be installed globally

No. A project scope is usually easier to review and roll back when only one repository needs the server. Use user scope for a personal tool that should follow you across projects.

Is stdio safer than Streamable HTTP

They create different boundaries. Stdio keeps the process local, while HTTP enables remote sharing and requires authentication. Safety depends on directories, credentials, network controls, and approvals, not on the transport name alone.

Can a token be stored in mcp.json

Avoid it. Keep a variable name in the configuration and provide the secret through environment variables or the provider’s sign-in flow. Inspect the diff before committing.

Why is a Claude Code URL entry skipped

The official reference says a URL entry also needs a type. Without it, Claude Code interprets the entry as stdio and skips it. Add the type that matches the service, such as http, sse, or ws.

When should I disable an MCP server

Disable it when logs show an unexpected call, permissions need redesign, a credential may have leaked, or the connection is no longer needed. Disabling is reversible and gives you a safe first isolation step.