The Origin MCP Server: Endpoints, Tools and Permissions

The Origin MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server is the way an agent talks to Origin hosting without you writing API calls. Origin is in Early Beta and subject to change, so this section starts with who can use it today and what it can see.

The server is currently available only in Cursor and Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., and Cursor says support for other agent harnesses is coming soon. It covers repository browsing and search, commits and branches, pull request reads and writes, reviews and comments, labels, reviewers and checks. Its tools only see repositories hosted on Origin at origin.cursor.com, addressed by their Origin namespace (owner) and repository name, and a repository that mirrors to Origin counts as hosted there.

That addressing rule trips people up. The tool schemas say a GitHub owner or organization name is not an Origin namespace unless list_namespaces returns it, so an agent should take the owner from list_namespaces or from an earlier Origin result and not assume the GitHub name carries over.

There are two endpoints and one transport. The choice of endpoint is how you decide, ahead of time, whether an agent is allowed to write at all.

Sending the header x-mcp-readonly: true to /mcp has the same effect as calling /mcp/readonly, which is handy when a client lets you set headers but not change the URL. The server speaks MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. over stateless streamable HTTP and supports tools only. Each JSON-RPC message is a POST with Content-Type: application/json, and you should expect plain JSON back, with no sessions and no server-sent event streams.

Cursor's tool reference lists every tool in listing order with an access class. Grouping them by what they touch makes the surface easier to hold in your head, and the counts below are tallied from that table.

Seventeen of the 35 tools appear on the read-only endpoint. A few of them have limits that shape how an agent should use them. grep_contents takes a regular expression matched case-sensitively unless you set literal or caseInsensitive, returns at most 1000 matching occurrences, sets limitHit when it reaches that cap, and has no pagination, so you narrow the query, filterPath, includes or excludes to reach other matches. Context lines before and after a match are capped at 10 each.

merge_pull_request deserves its own note because it understands stacks. It can land a pull request, or a stack up to and including it, and on a stack it lands every open pull request from the stack root through that one in a single commit, checking every member first and landing nothing if one is blocked. It requires the expected head SHA of the pull request, takes an optional mergeMethod of merge or squash, and where a merge queue owns the branch it queues the pull request instead, so mergeCommitSha and mergedPrefix come back empty because nothing has landed yet.

Tool calls run as you, and two limits stack on top of each other. This section covers whose permissions apply and how clients are meant to pause before a risky call.

Calls are attributed to you, and from Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. they show as your name via Grok Bot. Your access and the client's scopes both limit what a tool can do, under the same permission checks and rate limits as the equivalent Origin API request. Each tool lists its required scopes: for example grep_contents needs repository:contents:read, and merge_pull_request needs repository:contents:write. Some write actions, such as approving a pull request, are available only in Grok Bot.

Tools that are destructive or hard to undo set _meta["cursor/requiresConfirmation"]: true in tools/list, and Cursor clients show an approval prompt before every call to such a tool. In the tool reference, six tools carry that flag: create_repository, sync_mirror, update_pull_request_base, merge_pull_request, dismiss_pull_request_review and update_pull_request_review_thread. Other MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. clients can use the same flag, or the standard destructiveHint annotation, to decide when to ask the user.

A client that handles failures well needs to know which kind it received. This section covers the two error shapes and the paging rule for list tools.

A tool that fails returns a normal MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool result with isError: true. The text content is a readable message followed by a request ID, and the structured content carries a category, a message, a requestId and, only when the call was rate limited, retryAfterSeconds and a rateLimit object. The category is one of not_found, forbidden, quota_exceeded, conflict, validation_error or upstream_failure, and Cursor asks you to include the request ID when reporting a problem. Unknown tools and invalid parameters are different: they return JSON-RPC errors instead of tool results.

List tools page like the Origin API. Pass the returned nextPageToken as pageToken, with the same filters, to read the next page. The detail that matters is repeating the same filters on every page request, so a client should keep them alongside the token.