# Connect Cursor and VS Code
URL: https://docs.autociso.io/developers/mcp/cursor-vscode/
Description: Add AutoCISO as an MCP server in Cursor or VS Code with safe token handling.

Add AutoCISO to Cursor or VS Code and ask about your compliance data straight from the editor's AI panel.

## Prerequisites

- An MCP token with the `mcp:read` scope — see the [MCP Quickstart](https://docs.autociso.io/developers/mcp/quickstart/) or [MCP Auth and Scopes](https://docs.autociso.io/developers/mcp/authentication/).
- Cursor or a recent version of VS Code with MCP support.

## Step 1 — Add the server config

Cursor reads `.cursor/mcp.json`; VS Code reads `.vscode/mcp.json`. VS Code lets you prompt for the token at launch with an `inputs` entry, so the secret never lives in the file.

**Cursor (.cursor/mcp.json)**

```json
{
  "mcpServers": {
    "autociso": {
      "url": "https://api.autociso.io/mcp",
      "headers": { "Authorization": "Bearer aci_REPLACE_ME" }
    }
  }
}
```

**VS Code (.vscode/mcp.json)**

```json
{
  "inputs": [
    {
      "id": "autociso_token",
      "type": "promptString",
      "description": "AutoCISO MCP token",
      "password": true
    }
  ],
  "servers": {
    "autociso": {
      "url": "https://api.autociso.io/mcp",
      "headers": { "Authorization": "Bearer ${input:autociso_token}" }
    }
  }
}
```

**Warning — Don't commit a real token**

Project-local config (`.cursor/mcp.json`, `.vscode/mcp.json`) is convenient but easy to commit by accident. Add these files to `.gitignore`, or prefer the VS Code **prompt-on-launch** form above so the token is never written to disk. Treat the token like a password and revoke it from **user menu → API Tokens** if exposed. See [API tokens](https://docs.autociso.io/developers/api-tokens/).

**Note — VS Code MCP schema may change**

VS Code's MCP config format depends on your editor version. If the example above doesn't load, check the current VS Code MCP documentation for the exact field names.

## Step 2 — Reload and verify

1. Reload the editor window so it picks up the new config.
2. Confirm **AutoCISO** appears in the MCP servers list.
3. In the AI panel, ask: **"List my open risks"** — the assistant calls `risk_register_list` and answers from your [Risk Register](https://docs.autociso.io/console/risk/register/). For more questions to try, see [MCP Capabilities](https://docs.autociso.io/developers/mcp/capabilities/).

## If something's wrong

| What you see | Likely cause | Fix |
|--------------|--------------|-----|
| No AutoCISO tools appear | Bad JSON, wrong file, or no reload | Validate the JSON, confirm the path, reload the window |
| `401` | Token typo or revoked | Re-enter or recreate the token |
| No AutoCISO tools, or fewer than expected | The token lacks the scope, or your plan does not include the feature | See [Scope is not entitlement](https://docs.autociso.io/developers/mcp/authentication/#scope-is-not-entitlement) |
| `404 NOT_FOUND` | MCP is not enabled for your deployment | Contact support |

For every other code, see [MCP Errors and Retries](https://docs.autociso.io/developers/mcp/errors/) and [MCP Troubleshooting](https://docs.autociso.io/developers/mcp/troubleshooting/).