MCP client setup
Step-by-step setup for Cursor, Claude, ChatGPT, Copilot, Raycast, Zapier, n8n, Make, and other MCP clients.
Any client that speaks MCP over Streamable HTTP can connect to
https://api.noru.tech/v1/mcp. For a client you use interactively, add the
server URL and let it sign you in with OAuth; you pick the organization and the
scopes on the consent screen and never handle a secret. The guides below show
the API-key configuration instead, which is what headless setups, stdio bridges
such as mcp-remote, and automation platforms need; create the key under
SettingsDeveloper first (see
API keys).
Ask Noru about stale evidence, failing controls, and audit readiness while you ship code in Cursor.
Requirements
- Cursor with MCP support enabled
- A Noru API key with the scopes your team needs
Setup
- Open Cursor Settings and go to MCP Servers.
- Add a new server with URL https://api.noru.tech/v1/mcp.
- Set Authorization header to Bearer YOUR_API_KEY.
- Restart Cursor and @mention Noru in chat.
Manual setup
Add Noru as an MCP server in Cursor settings using HTTP + bearer auth.
{ "mcpServers": { "noru": { "url": "https://api.noru.tech/v1/mcp", "headers": { "Authorization": "Bearer YOUR_API_KEY" } } }}What you can do in Cursor
- "Show controls that are overdue this week"
- "List evidence expiring in the next 7 days"
- "Summarize open remediation work by owner"
- "What changed in access controls today?"
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
401 on every call | The key is missing, mistyped, expired, or revoked; or the header lacks the Bearer prefix | Check the Key Prefix in SettingsDeveloper against your config, confirm the row is not Revoked, and make sure the header reads Authorization: Bearer noru_… |
401 after it used to work | Pointing at app.noru.tech instead of api.noru.tech, or the OAuth refresh token is older than 30 days | Use https://api.noru.tech/v1/mcp; remove and re-add the server to re-authorize |
| "You must belong to a Noru organization to authorize MCP access." | Your account has no organization membership yet | Accept your invitation or create an organization, then retry |
| The client acts in the wrong organization | The remembered approval is bound to the organization you picked last time | Remove the server from the client and re-add it; pick the right organization in the consent screen |
403 with insufficient_scope, or a tool says FORBIDDEN | The key was created without that scope, or your role is viewer and the tool writes | For a key, create a new one with the scope. For OAuth, re-authorize and tick the scope; a viewer cannot obtain write scopes at all |
| The client lists fewer tools than you expected | Tools are filtered by scope, and privacy tools also need the privacy segment | Call getMcpCapabilities to see the granted scopes and visible tools; add scopes as above |
402 PAYMENT_REQUIRED on evidence tools | The organization's billing is not active | An admin checks SettingsBilling or contacts the Noru team |
405 Method Not Allowed when connecting | The client is using the legacy HTTP+SSE transport and sent GET | Update the client, or wrap it with mcp-remote as shown in the stdio guides |
429 RATE_LIMITED | More than 500 requests in 10 minutes on this credential | Wait for Retry-After; give busy clients their own key |
A delete* or merge* tool asks for confirmation | Destructive tools ask for confirmation in clients that support elicitation | Read the summary and confirm, or decline (the tool returns CANCELLED) |
Related
- MCP server for scopes, tools, and the OAuth flow
- API keys
- Developer settings guide
Last updated on