Veyra

Connecting a payment tool

How to add a payment tool to Cursor

Add a remote MCP payment server to Cursor's mcp.json with a URL and Authorization header, keep the token out of the repo, and test it safely.

Add the server to Cursor's mcp.json under mcpServers with its url and a headers object carrying the Authorization bearer token. Use the global file in your home directory rather than the project's .cursor/mcp.json if the repository is shared.

Why is this harder than it sounds?

Cursor reads MCP servers from two places: a project file inside the repository and a global file in your home directory. The project file is convenient and easy to commit by accident, and a committed payment token is a spendable credential in your git history. Cursor's agent also runs with a lot of context it didn't write, from open files to fetched docs, so the limits on the payment server are what really decide what it can spend.

How do you do it?

  1. Make a dedicated endpoint. Create a credential just for Cursor with low limits. If the agent will only pay a few services, add their addresses to a recipient allowlist.
  2. Edit the global config. Open ~/.cursor/mcp.json (or the project's .cursor/mcp.json if it is git-ignored) and add an entry under mcpServers with url and headers.
  3. Use a remote URL with headers. For a hosted server the entry is { "url": "https://…/mcp", "headers": { "Authorization": "Bearer …" } }. Cursor's docs describe remote servers configured this way, and headers can read an environment variable with "Bearer ${env:VEYRA_TOKEN}" so the token stays out of the file.
  4. Enable it and check the tools. Open Cursor's MCP settings, make sure the server is enabled and its tools are listed. Ask the agent to read its budget.
  5. Test on a simulated source. Ask for one small payment and one in the approval band. Check the approval request arrives and the agent waits instead of retrying.
  6. Keep manual tool approval on. Leave Cursor's tool-call confirmation on for this server until you trust it. The server's policy is the real control; the confirmation is an extra look.

What it does not mean

  • A token in .cursor/mcp.json is not secret if the file is committed. Add it to .gitignore or use the global file.
  • Cursor auto-running tools does not change the server's limits. It changes how often you see a call before it is made.
  • The tool list Cursor shows is not a permission model. Every listed tool can be called whenever the agent decides to.

Common questions

Can one Cursor config hold several payment endpoints?

Yes, as separate mcpServers entries, but each one is a separate budget. Most setups only need one per agent.

Will background agents use it too?

Any agent that loads the config can call the tools. If you only want interactive use to pay, keep the server out of configs that unattended runs pick up.

Where does Veyra fit?

Veyra's docs give this exact block for Cursor: an mcpServers entry named veyra with url https://veyra.money/api/mcp and headers { Authorization: Bearer veyra_… }. Policy is enforced on Veyra's server whatever the client does, so a misconfigured Cursor can fail to pay but cannot pay past your limits. Rotate the credential from the endpoint page if it ever ends up somewhere it shouldn't.

Start free with a simulated walletRead the docs

Sources

Terms on this page

This page explains how agent payments and the related technology work. It is not financial, investment, legal or tax advice. Protocols and provider features change; check the linked official sources before relying on a detail.