Cursor MCP website builder set-up: one mcp.json entry, then ask the agent

The entry

Cursor reads MCP servers from two files, according to its MCP documentation: ~/.cursor/mcp.json in your home folder for servers available in every project, and .cursor/mcp.json inside a project for that project alone. For Anticode, the whole entry is a name and a URL:

• { "mcpServers": { "anticode": { "url": "https://anticode.dev/mcp" } } }
• Save the file, and Cursor discovers that the server needs sign-in, opens your browser at Anticode's consent page, and finishes when you approve.

Cursor's OAuth follows the authorization-code flow with PKCE and registers itself as a public client, which is exactly what Anticode's authorization server accepts: PKCE with S256 is mandatory and no client secrets exist. On the consent page you see the client's name and can narrow the grant to read-only before approving.

With a token instead

For a machine where a browser sign-in isn't practical, make a personal token on anticode.dev/mcp (read-only or read-and-write; it's shown once) and add a headers object with "Authorization": "Bearer ${env:ANTICODE_TOKEN}". Cursor substitutes ${env:NAME} from your environment, so the token itself never sits in the file. That matters most for the project file, which tends to get committed.

Global or per project

With the project file, each teammate still signs in as themselves, and their own Anticode account decides which projects the agent can reach.

What the agent can do

• Read a project with get_project, or fetch its anticode.json, the open format described by a public JSON Schema.
• Edit text, order and theme by writing anticode.json back with the version it read; a stale version is refused with a conflict, never silently overwritten.
• Run a model build or change after get_build_quote returns the cost against your daily and weekly allowance and you agree. The quote id lasts 15 minutes and works once.
• Publish or unpublish, with the page rendered by Anticode's design engine and checked by the server's security gate.
• Read analytics and form submissions, the latter labelled as untrusted content because visitors wrote them.

It can't upload or delete files, delete projects or change account settings. If the builder is open in a browser, it redraws when the agent edits the project and offers to undo.

Approving tool calls

Cursor asks for approval before running MCP tools by default, and you can expand the prompt to see the arguments. Keep that on for publish_project and start_build at least: a publish is visible to the world and a build uses your allowance. Cursor's run modes can let allowlisted tools run straight away; reading tools such as list_projects and get_analytics are reasonable candidates.

A practical split

The pairing works well when a developer owns the exported Next.js app in Cursor and a marketing page stays on Anticode. In one window the agent changes the app's code; through MCP it updates the hosted page's headline, checks its sign-ups and republishes, without anyone switching tools. For deciding when code alone is the better route, see Anticode vs Cursor.

Limits

• No markup injection. anticode.json text is escaped and the design engine renders it; the agent can't add raw HTML or scripts to a published page.
• No in-editor page preview unless your Cursor version can display MCP Apps; otherwise preview_project returns a short summary.
• CMS data sections aren't filled in preview_project, though publishing through MCP renders them from your entries; check those sections in the builder.
• Rate limits: 60 tool calls a minute per account, so an agent stuck in a loop is slowed down.

Troubleshooting

The server shows as needing authentication

Open Cursor's MCP settings and start the sign-in again, or check the token in your environment.

Write tools return an access error

The grant or token is read-only. Make a read-and-write token, or reconnect.

version_conflict on a write

Someone changed the project since the agent read it. Ask the agent to fetch the file again and re-apply its edit.

For the full tool list, see the MCP server; for the file format, anticode.json.

Questions people ask

Do I need a token if I use OAuth?

No. OAuth signs Cursor in through your browser. Tokens are for set-ups where that isn't possible.

Can I revoke Cursor's access?

Yes. On anticode.dev/mcp you can disconnect the app or revoke the token; either ends access at once.

Does the agent see my form submissions by default?

Only if it calls list_form_submissions on a connection you approved. With Cursor's default approvals, you see that call before it runs.

Sources

1. Cursor Docs: Model Context Protocol (MCP), checked 24 October 2026