Skip to content
Artifactum Content Objects · MCP
Open vault

Clients

Cursor

Cursor is the MCP client with a proven Artifactum golden path (connect + store + get + soft-delete). Use Streamable HTTP against https://mcp.artifactum.ai/. Do not run a local python -m artifactum stdio process against production.

What you need

  • An Artifactum invite (hosted) or your dedicated endpoint (single-tenant).
  • A long-lived MCP Bearer issued for your environment — never commit it, never paste it into chat or git.
  • Cursor editor and/or Cursor CLI (cursor-agent).

Official Cursor MCP docs: MCP in Cursor · MCP in Cursor CLI.

Config

Global file: ~/.cursor/mcp.json. Project file: .cursor/mcp.json (do not commit a real Bearer). Cursor interpolates ${env:NAME} in headers. 

{
  "mcpServers": {
    "artifactum": {
      "url": "https://mcp.artifactum.ai/",
      "headers": {
        "Authorization": "Bearer ${env:ARTIFACTUM_MCP_BEARER}"
      }
    }
  }
}

Put the token in the process environment as ARTIFACTUM_MCP_BEARER (token only, no Bearer prefix in the variable). The JSON must not contain a live secret.

Editor vs CLI

Dock/Spotlight Cursor.app and a terminal cursor-agent are different processes. A green editor does not feed the CLI. Export the variable in the shell that runs cursor-agent. GUI apps on macOS do not read .zshrc. 

export ARTIFACTUM_MCP_BEARER   # token only; never print
cursor-agent mcp list          # expect: artifactum: ready
cursor-agent mcp list-tools artifactum

If the CLI says requires_authentication and suggests mcp login, the Bearer is missing from that process. Do not run mcp login. Dynamic client registration is off on the hosted identity tenant; login would try to mint extra OAuth apps. Fix the env and retry.

On a Mac that also has Grok Build, agent may be Grok, not Cursor. Use Homebrew cursor-agent (/opt/homebrew/bin/cursor-agent).

Golden path

  1. Connect (tools listed).
  2. Honor initialize standing order — getting started.
  3. get_upload_url → HTTP PUT → store.
  4. New session: get_content by the same key.

Cursor can use the presigned download_url. Claude-class hosts cannot — see known issues.

OAuth (do not start here)

Daily path on a Safari-default Mac is Bearer. That is a first-class supported path, not a fallback until OAuth works. Cursor’s desktop OAuth callback is http://localhost:8787/callback, which Safari HTTPS-First can break the same way as Grok Build. Hosted https callbacks are a different story; do not switch your default browser as product advice.