Entity Bind and Cursor

1. 01

   Prove the endpoint answers

   Same first move as any client, and for the same reason: it separates a configuration problem from a reachability problem before you have spent an afternoon on the wrong one. A 421 Invalid Host header is refused before authentication and before routing, so no amount of editing the client config will clear it.

   Prove the endpoint answers

   curl -s https://host.example.com/healthz
   
   curl -s https://host.example.com/mcp \
     -H "Authorization: Bearer $ENTITYBIND_API_KEY" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

2. 02

   Add the server at project or user scope

   Project scope keeps the server with the repository it belongs to; user scope makes it available everywhere. The object is identical either way, and the key under mcpServers is the display name.

   Add the server at project or user scope

   {
     "mcpServers": {
       "entitybind": {
         "type": "http",
         "url": "https://host.example.com/mcp",
         "headers": {
           "Authorization": "Bearer rk_YOUR_KEY_HERE"
         }
       }
     }
   }

3. 03

   Or, if the client stores credentials separately

   Clients that keep secrets out of the server config hold them in a vault keyed by the server URL, with a credential type per entry. A token presented unchanged on every request is what a vault calls static_bearer. The URL in the credential entry has to be byte-identical to the one in the server entry, trailing slash included: if it is not, the vault finds no credential, the client presents none, and what you see is an unauthorised response rather than a configuration error the client can describe.

   Or, if the client stores credentials separately

   {
     "mcpServers": {
       "entitybind": { "type": "http", "url": "https://host.example.com/mcp" }
     },
     "mcpCredentials": {
       "https://host.example.com/mcp": {
         "static_bearer": "rk_YOUR_KEY_HERE"
       }
     }
   }

4. 04

   Tell the agent what an abstention is

   Put two things in the agent's own instructions before it calls anything. An abstention is a successful answer rather than an error: the tool returns a ranked shortlist, a typed reason, the column that would have decided, and a review id, and it costs nothing. And a confidence number is read against the recorded evidence behind that particular decision, not as a universal score. Confidence bounds depend on the recorded evidence population; there is no universal score for every match. Read match_confidence_basis and the evidence. A 0.99 filter can return some v8 adjudicated matches while excluding valid identifier matches, so validate its coverage cost on your own inputs.

Cursor sits with Claude Code and Claude Desktop on the same shelf: configure and call. If you are weighing a shipped integration against a pattern, the line between the two shelves is drawn on the hub.