BREAKING: Cursor plugin drops API-key MCP auth to restore OAuth

src/plugins/cursor/content/.cursor-plugin/plugin.json

@@ -10,16 +10,5 @@
   "keywords": ["braintrust", "mcp", "ai", "evaluation", "experiments", "observability", "logs", "tracing"],
   "logo": "logo.svg",
   "hooks": "hooks/hooks.json",
-  "mcpServers": "mcp.json",
-  "variables": {
-    "type": "object",
-    "properties": {
-      "BRAINTRUST_API_KEY": {
-        "type": "string",
-        "title": "Braintrust API key",
-        "description": "API key for the Braintrust MCP server"
-      }
-    },
-    "required": ["BRAINTRUST_API_KEY"]
-  }
+  "mcpServers": "mcp.json"
 }

src/plugins/cursor/content/README.md

@@ -10,10 +10,9 @@ the Braintrust VS Code extension for Cursor.
 
 ## Prerequisites
 
-- A [Braintrust account](https://braintrust.dev)
+- A [Braintrust account](https://braintrust.dev) (MCP uses OAuth)
 - Cursor with the CLI or desktop app
 - The [Braintrust CLI](https://www.braintrust.dev/docs/reference/cli/quickstart)
-- A Braintrust API key to use the MCP server
 
 ## Install from Cursor Marketplace
 
@@ -22,9 +21,33 @@ Use `/add-plugin` in Cursor and search for **Braintrust**, or install from the
 Braintrust MCP server and tracing hooks. For tracing, install and authenticate
 the `bt` CLI, then run `bt trace enable cursor --project my-coding-agent`.
 
-The Braintrust MCP server uses `https://api.braintrust.dev/mcp`. Configure its
-`BRAINTRUST_API_KEY` variable in Cursor's plugin settings. MCP access and tracing
-use separate authentication: `bt login` authenticates the tracing CLI.
+The Braintrust MCP server uses `https://api.braintrust.dev/mcp` and Cursor's
+OAuth flow for per-user authentication. MCP access and tracing use separate
+authentication: `bt login` authenticates the tracing CLI.
+
+### Breaking change: API-key authentication removed
+
+This plugin no longer accepts `BRAINTRUST_API_KEY` for MCP authentication.
+Any key previously saved in the plugin settings will no longer be used. After
+updating, authorize Braintrust through Cursor's OAuth prompt. If you must keep
+using an API key, remove the plugin's MCP server and configure it manually in
+Cursor's MCP settings, with `BRAINTRUST_API_KEY` available in Cursor's
+environment:
+
+```json
+{
+  "mcpServers": {
+    "braintrust": {
+      "url": "https://api.braintrust.dev/mcp",
+      "headers": {
+        "Authorization": "Bearer ${env:BRAINTRUST_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+Do not register a second server named `braintrust` alongside the manual one.
 
 The existing VS Code extension remains available from Cursor's extension
 panel. It reads `BRAINTRUST_API_KEY` from Cursor's environment and registers
@@ -57,7 +80,8 @@ Reload the Cursor window after setup. Tracing uses the user hooks even when
 local plugin imports are unavailable. MCP access still requires an active plugin.
 
 Use `--profile` or `--org` to select a different Braintrust account or
-organization. To use MCP, configure `BRAINTRUST_API_KEY` in Cursor's plugin settings.
+organization. The plugin's MCP server prompts you to authorize Braintrust with
+OAuth when you first use it.
 
 ## Data handling
 

src/plugins/cursor/content/mcp.json

@@ -1,10 +1,7 @@
 {
   "mcpServers": {
     "braintrust": {
-      "url": "https://api.braintrust.dev/mcp",
-      "headers": {
-        "Authorization": "Bearer ${BRAINTRUST_API_KEY}"
-      }
+      "url": "https://api.braintrust.dev/mcp"
     }
   }
 }

src/plugins/cursor/validate.sh

@@ -24,8 +24,7 @@ assert manifest['mcpServers'] == 'mcp.json'
 assert manifest['logo'] == 'logo.svg'
 assert manifest['repository'] == 'https://github.com/braintrustdata/braintrust-cursor-extension'
 assert manifest['license'] == 'MIT'
-assert manifest['variables']['properties']['BRAINTRUST_API_KEY']['type'] == 'string'
-assert manifest['variables']['required'] == ['BRAINTRUST_API_KEY']
+assert 'variables' not in manifest
 package = json.loads((root / 'package.json').read_text())
 lock = json.loads((root / 'package-lock.json').read_text())
 assert package['publisher'] == 'braintrustdata'
@@ -39,7 +38,6 @@ assert package['repository']['url'] == manifest['repository']
 mcp = json.loads((root / 'mcp.json').read_text())
 assert mcp['mcpServers']['braintrust'] == {
     'url': 'https://api.braintrust.dev/mcp',
-    'headers': {'Authorization': 'Bearer ${BRAINTRUST_API_KEY}'},
 }
 assert 'MIT License' in (root / 'LICENSE').read_text()
 config = json.loads((root / manifest['hooks']).read_text())