API-317: Fix the Cursor install flow — explicit key flows instead of the placeholder deep link - #505
Closed
gulshngill wants to merge 1 commit into
Closed
Conversation
The public Cursor instructions relied on a deep link whose base64 config embeds a placeholder API key, so the "one-click" install lands broken and the user has to decode and hand-edit ~/.cursor/mcp.json. Document two flows where the key is supplied explicitly instead: nansen mcp install cursor (real key from login, verified with nansen mcp verify cursor) and a plain-JSON copy-paste config with a visible YOUR_API_KEY slot, merge guidance, permissions note, and an authenticated in-Cursor check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The public Cursor instructions point at a deep link whose base64-encoded config embeds
"NANSEN_API_KEY": "REPLACE_THIS"— the "one-click" install lands broken, and fixing it means decoding an opaque payload or hand-editing~/.cursor/mcp.json. It also bridges throughnpx mcp-remote ... --allow-httpeven though the server is HTTPS and Cursor speaks streamable HTTP natively.Decision: explicit key flows, no personalized deep link. A personalized link would put a live API key inside a URL (clipboard history, chat logs, link previews) and still be an opaque payload; and a static link can't collect a key at all — Cursor's deeplink install saves the decoded config as-is, so a placeholder is inherent to that design.
This PR adds a
### CursorREADME subsection (stacked on #502, which providesnansen mcp install|verify):nansen login --api-key <key>→nansen mcp install cursor→ restart →nansen mcp verify cursor(one real authenticated data call).~/.cursor/mcp.jsonblock with a visibleYOUR_API_KEYslot (exact shapeinstallwrites, soverifyaccepts it with no drift warnings), merge guidance for existing configs, a macOS/Linuxchmod 600note, and an authenticated in-Cursor check (paid tool call —tools/listanswers keyless, so visible tools prove nothing).Follow-up (docs site): https://docs.nansen.ai/mcp/connecting still hosts the deep link; this subsection is written to be adopted there verbatim.
Verification
From a clean
HOME(no~/.cursor/), with a real key:nansen mcp install cursor→ file created0600, real key written, zero placeholders.nansen mcp verify cursor→ ✓ authenticated MCP data call succeeded.verify cursor✓, no drift warnings.tools/call(token_info, the request Cursor's agent sends) with the manually-configured key → real data returned.Cursor's own docs confirm native
url+headerssupport inmcp.json.Checklist
npm test— 2010 passed, 2 skipped;npm run lintclean)src/schema.jsonupdated if new commands or flags were added — n/a, docs-onlyREADME.mdupdated🤖 Generated with Claude Code