Two changes ship in this release: Cursor joins the connector catalogue, and the per-server tab keeps a stable name whether or not this plugin is active.
New connector profile — Cursor
Adds CursorConnectorProfile (slug cursor), the fifth profile alongside Claude, ChatGPT, Gemini, and Grok. It surfaces automatically wherever the registry is consumed: its own tab in the per-server tab strip, consent-screen branding and icon, a Settings checkbox, and a real name in the Connections panel instead of the "Other (OAuth)" bucket.
Cursor publishes two fixed OAuth callbacks (Cursor MCP docs, § "Static redirect URL"), both whitelisted:
https://www.cursor.com/agents/mcp/oauth/callback— Web and Cursor Agentshttp://localhost:8787/callback— desktop IDE and CLI
Cursor multiplexes every MCP server through these two endpoints and disambiguates via the OAuth state parameter, so they are not per-site values. Both already pass ClientRegistrationController::is_valid_redirect_uri() unchanged — https for the web callback, the existing loopback exemption for the desktop one. The desktop entry is plain http on purpose: RFC 8252 §7.3 makes that correct for a native-app callback.
cursor:// is obsolete — the 0.8.3 filter is not needed here. Until roughly July 2026 the desktop IDE used the private-use scheme cursor://anysphere.cursor-mcp/oauth/callback; Cursor moved off it to loopback (staff-confirmed 2026-07-08). Operators do not need to enable acrossai_pro_native_app_redirect_schemes for Cursor, and any third-party guide still saying to whitelist cursor:// is stale.
Cursor's default path is Dynamic Client Registration — paste only the MCP URL into ~/.cursor/mcp.json (or a project-local .cursor/mcp.json) and it registers itself. Because Cursor exposes no GUI for OAuth credentials, the static-credential fallback is a hand-edited auth block; the whitelist keeps the admin Generate credentials button available for that case, and the generated setup instructions render the exact mcp.json snippet to copy. The client secret is not inlined into that snippet — it stays behind the existing Reveal control.
DCR attribution (matches_dcr_client()) checks Cursor-owned redirect hosts first, then the desktop loopback callback matched on host and port 8787 and path /callback, then a whole-word cursor fallback on client_name. The loopback check deliberately requires all three components: matching a bare localhost host would misattribute every other native OAuth client on the site (Claude Code, Gemini CLI, Codex) as Cursor.
Troubleshooting: Cursor's desktop sign-in listens on a hard-coded port 8787. If another local process holds that port, the callback lands in the wrong process and authentication fails with no useful error.
Tab renamed to "Connectors/Integrations"
acrossai-mcp-manager ships a placeholder tab (AIConnectorsPromoTab) labelled Connectors/Integrations. This plugin registered the real tab under the same slug (ai-connectors) at the same priority (35) but labelled it AI Connectors — so activating AcrossAI Pro swapped the tab in place and the name appeared to change out from under the operator.
Every user-visible occurrence is now Connectors/Integrations: the server-tab label, AIConnectorsTab::label(), the tab on the shared AcrossAI Settings page, the acrossai-pro landing submenu titles, the admin-notice source labels and Wordfence notice title, and the "Connect until you revoke access from the … tab" copy in the Claude, ChatGPT, Grok, and Gemini profiles.
Display strings only — class names and slugs (ai-connectors, pro) are unchanged, so no admin URLs, hooks, or filters move. Translators: the affected strings are new msgids and need re-translating.
⚠️ Operator note — rebuild vendor/ when deploying from source
This release adds a new class file (includes/CursorConnectorProfile.php), and the Jetpack Autoloader resolves this plugin's classes from a static classmap generated at composer dump-autoload time — there is no PSR-4 fallback map. A source checkout whose vendor/ predates this release will fatal:
PHP Fatal error: Uncaught Error: Class "AcrossAI_Pro\Includes\CursorConnectorProfile"
not found in .../includes/Main.php:233Run composer install --no-dev -o (or composer dump-autoload --no-dev -o) after updating.
Installs updating through Freemius are unaffected — the release pipeline regenerates the classmap before packaging.
Also in this release
Refreshed release copy that had gone stale: the plugin-header Description and README short description both still said "AI Connectors tab" and named only Claude; the Description section still claimed "three connector profiles" when five now ship; Tags: gains cursor. Also dropped an outdated claim that the plugin ships no runtime composer dependencies (untrue since BerlinDB, the Freemius SDK, and the Jetpack Autoloader were vendored).
Known gaps
- The Cursor OAuth round trip has not yet been exercised end-to-end against a licensed install — tab render, consent branding, and Connections attribution on both the desktop and web surfaces.
- Test suite still does not run in CI — see #48.
Full changelog: v0.9.1…v0.9.2 · Ships #46, #47, #49.