Cursor project .cursor/mcp.json or global ~/.cursor/mcp.json for Sume?

Use .cursor/mcp.json in the project root when the whole repo should offer Sume, and ~/.cursor/mcp.json when only you should. Both take the same url entry. Share the OAuth form, which is just the URL, and keep anything secret out of the committed file.

The two files

Cursor's docs list project-level .cursor/mcp.json and global ~/.cursor/mcp.json. A remote entry uses a url and optional headers. Cursor resolves variables in command, args, env, url and headers, including ${env:NAME}.

{
  "mcpServers": {
    "sume": { "url": "https://mcp.sume.com/mcp" }
  }
}

OAuth first, key second

With the entry above, Cursor prompts for sign-in and the consent page appears on the MCP host. A new teammate gets mcp:read unless they switch Write on, so committing the entry does not grant anyone write access.

If you need an API-key session, for example for a headless job, the key goes in a header: "Authorization": "Bearer ${env:SUME_API_KEY}". That session sees all tools. Put it in the global file, or keep the env variable set only where it is needed, and never commit the value.

Check it works

Call tools_list once after connecting. If it shows only read tools, that is the default, not a fault.