Scalekit Auth Plugins for Cursor — the auth stack for agents.
Add SSO, SCIM, MCP Auth, agent auth, and tool-calling from your Cursor editor.

📖 Documentation · 💬 Slack

---

A Cursor plugin marketplace that brings production-ready authentication to your existing projects — right from inside Cursor.

Pick the auth you need: MCP auth, SSO, SCIM provisioning, agent auth, or full-stack authentication — and let Cursor's agent do the wiring for you.

---

Plugins

Plugin	What it does	Status
mcp-auth	OAuth 2.1 authorization for MCP servers — discovery endpoint, token validation, scope enforcement	Available
agent-auth	Scalekit Agent Auth so AI agents can act in third-party apps (Gmail, Slack, Calendar, Notion) on behalf of users	Available
full-stack-auth	Full-stack web authentication — login pages, sessions, protected routes, RBAC, and more	Available
modular-sso	Enterprise SSO with 20+ identity providers (Okta, Entra ID, JumpCloud) via SAML/OIDC	Available
modular-scim	SCIM 2.0 user provisioning, group sync, and directory lifecycle management	Available

---

Installation

The plugin bundle is currently under review for the Cursor Marketplace. Once approved, you you will be able to install it directly from the Cursor plugin panel in a single click.

Until then, use the bootstrap installer:

curl -fsSL https://raw.githubusercontent.com/scalekit-inc/cursor-authstack/main/install.sh | bash

The installer:

• downloads the latest cursor-authstack repository
• installs each plugin into ~/.cursor/plugins/local/<plugin-name>
• verifies each installed plugin root contains .cursor-plugin/plugin.json
• prints the next steps to reload Cursor and confirm the plugins loaded

After it finishes:

1. Restart Cursor, or run Developer: Reload Window
2. Open Settings > Plugins
3. Verify the Scalekit plugins are available and their rules, skills, and MCP servers load correctly

Local development

If you're iterating on this repository locally, run the installer from your working tree:

CURSOR_AUTHSTACK_SOURCE_DIR="$PWD" ./install.sh

That uses the repo-local installer directly. To symlink plugins into ~/.cursor/plugins/local instead of copying them, use:

CURSOR_AUTHSTACK_SOURCE_DIR="$PWD" CURSOR_AUTHSTACK_INSTALL_MODE=symlink ./install.sh

If you prefer a manual install, each plugin can also be copied into ~/.cursor/plugins/local/<plugin-name> as long as .cursor-plugin/plugin.json sits at that plugin root.

---

Plugin Details

mcp-auth

The mcp-auth plugin adds production-ready OAuth 2.1 authorization to any MCP server. Once installed, Cursor's agent will:

• Serve a /.well-known/oauth-protected-resource discovery endpoint so MCP clients (Claude Desktop, Cursor, VS Code) can automatically find your authorization server
• Add a Bearer token validation middleware that checks audience, issuer, expiry, and scopes before any MCP tool runs
• Wire up per-tool scope enforcement so each tool only executes for users with the right permissions
• Support both Node.js (Express / FastMCP) and Python (FastAPI / FastMCP) out of the box

This plugin uses Scalekit as the OAuth 2.1 authorization server.

agent-auth

The agent-auth plugin implements Scalekit Agent Auth — so your AI agents can act on behalf of users in Gmail, Slack, Notion, Google Calendar, and 40+ other connected services.

Skills:

• agent-auth — integrates Scalekit Agent Auth with OAuth flows and automatic token refresh
• building-agent-mcp-server — creates a Scalekit MCP server with multi-service tool access
• production-readiness-scalekit — production readiness checklist for agent OAuth flows

full-stack-auth

The full-stack-auth plugin adds end-to-end authentication to B2B and AI apps using Scalekit. One integration enables: social sign-in, magic links, enterprise SSO, workspaces, MCP authentication, SCIM provisioning, and user management.

Skills for major stacks: Next.js, Django, FastAPI, Flask, Go (Gin), Spring Boot, Laravel.

Additional skills: logout, access control, admin portal, API key auth, OAuth2 for APIs, session management, auth migration, and production readiness.

modular-sso

The modular-sso plugin integrates enterprise SSO with existing user management systems. It handles IdP-initiated and SP-initiated login, attribute mapping, JIT provisioning, and enterprise customer onboarding via the admin portal.

modular-scim

The modular-scim plugin adds SCIM 2.0 directory sync to applications. It handles real-time user provisioning, deprovisioning, and group membership changes from enterprise identity providers.

---

Prerequisites

• Scalekit account with client_id and client_secret
• Cursor installed and configured
• Project where you want to add authentication

---

Helpful Links

Documentation

• Scalekit Documentation — Complete guides and API reference
• SSO Quickstart — Implement enterprise SSO
• MCP Auth Guide — Secure MCP servers
• Agent Auth Guide — Authentication for AI agents

Resources

• Admin Portal — Manage your Scalekit account
• API Reference — Complete API documentation
• Code Examples — Ready-to-use snippets

---

Contributing

Contributions are welcome! Please see AGENTS.md for contribution guidelines.

1. Fork this repository
2. Create a branch — git checkout -b feature/my-plugin
3. Make your changes following the plugin structure
4. Test locally
5. Open a Pull Request

---

License

This project is licensed under the MIT license. See the LICENSE file for more information.