mcp

Cato AI Labs disclosed CVE-2026-50548 and CVE-2026-50549, a pair of 9.8 CVSS flaws in Cursor's terminal sandbox. A poisoned MCP response or web result can escape the sandbox and run code. Cursor 3.0 is the fix.

Use stdio for a local server one client launches, use Streamable HTTP for anything remote or multi-client, and do not build new HTTP+SSE servers -- that transport was deprecated in the 2025-03-26 MCP spec. Here is the decision, the wire-level differences, and the code for each.

On 2026-06-30 Microsoft showed the Binlog MCP Server running unattended in a GitHub Agentic Workflow, so an agent reads the .binlog and comments a root cause the moment a CI build breaks.

If MCP tools disappear around Claude Code compaction, distinguish a failed connection from deferred tools, authentication, permissions and discovery before reconnecting.

MCP error -32000: Connection closed reports a closed transport in the TypeScript SDK. Diagnose startup failures, later disconnects, paths, stdout and HTTP separately.

Wire the Agent Governance Toolkit into a Microsoft Agent Framework 1.0 agent so every tool call is checked against a YAML policy and written to a tamper-evident audit trail. Full C# middleware, policy file, and a hash-chained audit sink.

Cursor 3.9 ships a plugin system and a unified Customize page so skills, rules, MCP servers, commands, and hooks travel together as one versioned unit.

Microsoft shipped Microsoft.AITools.BinlogMcp on 2026-06-17, an MCP server that exposes 15 tools so Claude or Copilot can diagnose build failures and slow targets straight from a .binlog file.

By default a local Cursor SDK agent runs every tool call without asking. Set local.autoReview to route Shell, MCP, and Fetch calls through the classifier, then steer it with the autoRun block in permissions.json. With code, the three-step evaluation order, and why none of it is a security boundary.

The Cursor SDK already persists agent state to disk so Agent.resume() can pick a conversation back up after a crash. This walks the SqliteLocalAgentStore default, the JsonlLocalAgentStore you can commit to git, and how to implement the LocalAgentStore interface for Postgres, Redis, or an in-memory CI store.