Securing MCP in Cursor and AI IDEs
You can strengthen MCP security in Cursor by routing approved connections through a centralized MCP gateway, scoping tool access, and enforcing client and endpoint policies. MCP Manager provides this central layer for monitoring and controlling MCP connections across your team.
This guide walks through the risks of adding MCP servers directly in Cursor, VS Code with GitHub Copilot, and other AI development tools, then shows how to centralize and govern those connections across your engineering organization.
Key Takeaways
- Direct MCP connections need approved servers, scoped credentials, and controls appropriate to the data and actions involved.
- MCP Manager centralizes team access, tool provisioning, and configured PII filtering for connections routed through its MCP gateways.
- Developers can use the same assigned MCP gateway across supported clients, with separate gateways where teams need different tools or policies.
- MCP Manager can export logs and traces through OpenTelemetry to compatible collectors for monitoring and retention.
- Combine MCP gateway policies with client allowlists and endpoint controls to restrict unauthorized connections.
Is It Safe to Add MCP Servers in Cursor?
Adding an MCP server in Cursor can be appropriate when you trust the server, limit its permissions, and review the data it can access. Cursor asks for tool approval by default and offers enterprise MCP allowlists and network controls. These controls should be part of your deployment. Cursor’s MCP documentation explains their scope.
The Problem with Per-Developer MCP Configs
When developers configure servers independently, IT may lack a current inventory of connections, credentials, and exposed tools. Downstream services may still log API activity, but security teams must piece together what happened across those separate records.
A GitHub MCP connection, for example, can expose operations allowed by its credential and the server’s tools. A local MCP server may also access files or other workstation resources under its process permissions. Without centralized controls, agents can use the exposed tools within the permissions granted by a user’s credentials and the client’s approval settings, while activity may remain fragmented across separate logs.
What “Safe” Actually Requires
For a team deployment, establish three controls across your AI clients:
- Maintain an inventory of approved servers and tools, then enforce it through client policies and MCP gateway provisioning.
- Keep activity attributable. Use per-user identity where possible, or maintain a documented link from each service-account action to the person who initiated it.
- Inspect tool arguments and results at runtime, with rules that block or redact sensitive data before it crosses an unauthorized boundary.
MCP Manager supports both per-user and shared downstream identities. A service account can be a valid choice; its permissions and the records linking actions to their initiators determine whether it fits the workflow.
How to Centralize MCP Across Cursor, Claude Code, and VS Code
Give developers an assigned MCP gateway URL that they can use across supported AI clients. Keep server configuration and policy in MCP Manager, with separate gateways where access requirements differ.
One URL Across Clients
A developer using Cursor and another using Claude Code can connect to the same MCP gateway. VS Code with GitHub Copilot can join the same setup through its MCP configuration. The gateway handles authentication, routes calls to the assigned servers, and applies the controls configured for that gateway.
Developers authorize their connection through MCP Manager, using your identity provider when SSO is configured. They may also need to authenticate to downstream services that require their own credentials. Servers configured with a shared identity do not require each developer to supply a separate credential.
The benefit is centralized administration across clients. You still configure each client, but you do not have to maintain its server list and tool policies independently.
Setting It Up
The deployment pattern looks like this:
- Register your approved MCP servers in MCP Manager. Include remote servers and local MCP servers connected through a workstation setup.
- Create a team and assign its MCP gateway. Teams grant gateway access, roles grant workspace administrative capabilities. Select the tools each gateway exposes and configure the appropriate downstream identity scheme. Follow the team gateway tutorial to configure this access model.
- Configure runtime rules on the MCP gateway. MCP Manager supports regex matching, Microsoft Presidio, and custom webhook engines. Use the detection method and action that fit your data policy; the engines are options you configure, not three mandatory checks on every call. The PII filtering documentation describes the available approaches.
- Distribute the connection instructions. In MCP Manager’s Connect this gateway menu, Cursor has a deep link, Claude Code has a generated command, and other clients can use the gateway URL. VS Code with GitHub Copilot uses its own MCP configuration format. Follow the client connection guide.
- Enforce the approved configuration using the client’s administrative controls and your endpoint management policies. Test whether users can add alternate endpoints, local servers, or unapproved clients.
For a local stdio MCP server, MCP Manager’s workstation agent creates an encrypted outbound connection to the MCP gateway while the server continues to run on the user’s machine. The tunnel agent does not place that server inside an isolated container. The workstation tutorial explains how to route local tool calls through the same governance layer.
What About Developers Routing Around It?
An MCP gateway governs traffic that passes through it. Enforce approved connector URLs in managed clients, restrict unauthorized software on company devices, and limit direct access to sensitive upstream systems where practical. MCP Manager supports static egress IPs that those systems can allowlist.
Network controls alone cannot identify a local stdio exchange as MCP traffic: the client and server communicate through process input and output. The server can still make outbound HTTPS calls. Endpoint controls therefore matter alongside network restrictions.
How to Audit MCP Usage in AI IDEs
Audit MCP usage by correlating the initiating identity, tool call, downstream account, and policy outcome. Protocol and service logs can contribute evidence, but they do not automatically provide a unified trail across your organization’s clients and servers.
What the MCP Gateway Logs
MCP Manager records the user and upstream identity, server, feature, timing, and policy outcomes for traffic routed through it. Correlation identifiers link the stages of an exchange so you can reconstruct a call. See the log field reference for the available records.
Shared downstream credentials can remain part of this setup. Verify that your records preserve the initiating user’s identity, or link automated activity to its initiating job and responsible owner. A downstream service-account name alone cannot tell you which person requested an action.
Review what the logs themselves retain. MCP Manager’s original inbound request is logged before request-side rules run, so redacting tool arguments does not remove the original values from that record. If sensitive payloads must be excluded from stored logs, discuss the workspace configuration.
Shipping Logs to Your Existing Stack
MCP Manager exports logs and traces through OpenTelemetry using OTLP/HTTP endpoints. Configure a compatible destination or collector, then route records into your observability platform or SIEM.
In-product retention depends on your plan and agreement. Use your own storage when you need a different retention period, and verify log access controls and export delivery. These records support audit reviews; they do not independently establish compliance.
Best Practices for AI IDE Security
Start with the servers, permissions, and data your developers actually use. Apply controls to those workflows and test them before expanding access.
1. Start with a Server Inventory
Record each server’s owner, source, credentials, tools, and data access. Include local servers and project-level configurations.
2. Set Permissions by Team and Task
Developers may need GitHub write tools, while a support workflow may only need Jira search and read tools. Restrict destructive tools, such as deletion, unless the workflow requires them. In MCP Manager, explicitly select an allowlist: newly assigned servers initially allow all capabilities. Feature governance controls what each gateway exposes.
3. Filter Sensitive Data Before It Reaches the Model
Configure rules for relevant personal data and secrets, then test both missed detections and legitimate content that gets blocked. Automated filtering cannot guarantee complete detection.
4. Review Tools Before Approving Them
A poisoned description can contain malicious instructions from the outset. A rug pull involves a later change to previously trusted metadata or behavior. Pinning approved names and descriptions can block changed metadata, but it cannot establish that the original tool or unchanged server code is safe.
5. Treat Documentation as Onboarding
Give developers the connection steps, available tools, approval process, and a contact for blocked workflows. Test the instructions with someone who did not build the setup.
6. Don’t Forget Local Servers
A workstation tunnel brings routed MCP calls under gateway governance. Continue to restrict the local server’s filesystem access, credentials, and outbound connections on the device.
Manage MCP Access Across the IDEs Your Team Uses
Your developers should be able to switch between Cursor, Claude Code, and VS Code with GitHub Copilot without rebuilding their MCP setup each time. With MCP Manager, you manage the servers, exposed tools, and data rules for their assigned MCP gateway centrally. Developers retain the write access their work requires, while you restrict unnecessary destructive actions and monitor MCP usage centrally.
Book an MCP Manager demo to walk through your team’s actual setup: which servers to connect, which tools to expose, and how to trace a tool call from the developer to the downstream system.
FAQ
Is Cursor MCP safe to use without an MCP gateway?
It can be, depending on the server, permissions, data, and configured controls. Cursor has tool approvals and enterprise controls. An MCP gateway adds centralized policy and audit visibility across clients. Individual experimentation still requires reviewing server trust and access.
Can I use one MCP gateway for Cursor, VS Code, and Claude Code?
Yes. These clients can use the same assigned MCP Manager gateway, with GitHub Copilot providing the AI workflow in VS Code. Connection steps differ by client. Use separate gateways when teams need different tools or policies.
How does MCP Manager handle local stdio servers on developer laptops?
A workstation agent establishes an encrypted outbound tunnel to MCP Manager. The local MCP server continues running on the developer’s machine. Calls routed through the MCP gateway receive its configured controls; direct local connections remain outside that path.
What MCP security threats should I worry about in AI IDEs?
Review tool poisoning, rug pulls, indirect prompt injection, exposed secrets, excessive permissions, and unnecessary destructive tools. The MCP spec treats tool descriptions as untrusted unless obtained from a trusted server. Combine server review with access restrictions and runtime inspection.
Does MCP Manager work with Windsurf MCP connections?
Yes. Windsurf’s Cascade supports remote MCP connections and OAuth. Connect it to your assigned MCP Manager gateway using the gateway URL, then authenticate to access the tools configured for your team.
How do I prevent developers from bypassing the MCP gateway?
Combine client connector allowlists, endpoint policies, scoped credentials, and upstream network restrictions where supported. Test alternate clients and local stdio servers as well as direct remote connections. Distributing or locking one configuration file does not cover every possible route.
Does using MCP Manager make an AI IDE workflow compliant?
No. Access controls, filtering, and audit records can support your compliance program. The outcome also depends on the data, connected services, contracts, retention, and operating procedures. Validate the complete workflow against your requirements rather than treating logging as a compliance guarantee.
Can I set different MCP access rules for different teams?
Yes. Teams receive access to assigned MCP gateways, and administrators provision tools and configure rules per gateway. For example, one gateway can expose GitHub write tools while another exposes Jira read tools. Administrative roles are separate from tool provisioning.
