fix: guard token leakage, header override, and silent failures

- Add .cursor/mcp.json to .gitignore to prevent token commits
- Guard registry headers from overriding injected GitHub Authorization
- Raise ValueError when no supported package type found instead of silent {}
- Add token injection and header-override regression tests
- Add CHANGELOG entry

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Sergio Sisternes

.gitignore

@@ -72,5 +72,7 @@ apm_modules/
 build/tmp/
 scout-pipeline-result.png
 .copilot/
+# Cursor MCP config (may contain auth tokens)
+.cursor/mcp.json
 .playwright-mcp/
 server.pid

CHANGELOG.md

@@ -28,6 +28,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `apm marketplace add` accepts GitLab-class hosts (`gitlab.com` and self-managed instances configured via `GITLAB_HOST` / `APM_GITLAB_HOSTS`); unsupported generic hosts now show separate recovery hints for GHES (`GITHUB_HOST`) and self-managed GitLab instead of only `GITHUB_HOST`. (#1149)
 - **GitLab monorepo marketplaces:** `apm install plugin@marketplace` now resolves plugins whose sources live in a subdirectory of the marketplace repository on GitLab-class hosts (`gitlab.com` and self-managed GitLab when classified as GitLab), matching explicit `git:` + `path:` semantics without requiring that hand-written object form. (#1149)
 - `apm install` now rejects unsupported flat-format `dependencies` (e.g. `dependencies: [owner/repo]`) with a clear error and structured-format hint instead of silently ignoring them; the resolver also surfaces `ValueError` from malformed transitive manifests as warnings instead of swallowing them. (#1189)
+- `apm install --target cursor` now emits Cursor-native MCP schema (`type: stdio` / `type: http`) instead of Copilot-only fields that Cursor silently discards; `.cursor/mcp.json` is gitignored to prevent accidental token commits. (#1240)
 - `shared/apm.md` no longer wraps the `target` input in a `|| 'all'` fallback. The defensive expression broke gh-aw's bare-expression substitution regex, causing consumer-supplied `target:` values to be silently dropped; the `import-schema` default already covers the omitted-input case. (#1185)
 - `apm install --target all` no longer enumerates the experimental `copilot-cowork` target, which was crashing project-scope installs with a "requires --global" error and made `gh aw` workflows that pin `target: all` unusable. (#1191)
 - Stabilized `test_install_over_defer_threshold_starts_live_once` on slow CI runners by joining the deferred-start timer thread instead of relying on a 100ms grace window. (#1191)

src/apm_cli/adapters/client/cursor.py

@@ -176,6 +176,10 @@ def _format_server_config(self, server_info, env_overrides=None, runtime_vars=No
                     header_name = header.get("name", "")
                     header_value = header.get("value", "")
                     if header_name and header_value:
+                        # Prevent registry-supplied headers from overriding
+                        # the injected GitHub token
+                        if header_name == "Authorization" and is_github_server:
+                            continue
                         resolved_value = self._resolve_env_variable(
                             header_name, header_value, env_overrides
                         )
@@ -255,6 +259,13 @@ def _format_server_config(self, server_info, env_overrides=None, runtime_vars=No
                     config["args"] = processed_runtime_args + processed_package_args
                     if resolved_env:
                         config["env"] = resolved_env
+            else:
+                raise ValueError(
+                    f"No supported package type found for Cursor. "
+                    f"Server: {server_info.get('name', 'unknown')}. "
+                    f"Available packages: "
+                    f"{[p.get('registry_name', 'unknown') for p in packages]}."
+                )
 
         return config
 

tests/unit/test_cursor_mcp.py

@@ -269,5 +269,78 @@ def test_format_npm_package_emits_type_stdio(self):
         self._assert_no_copilot_fields(config)
 
 
+class TestCursorTokenInjection(unittest.TestCase):
+    """Test GitHub token injection for Cursor remote servers."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.cursor_dir = Path(self.tmp.name) / ".cursor"
+        self.cursor_dir.mkdir()
+
+        self.adapter = CursorClientAdapter()
+        self._cwd_patcher = patch("os.getcwd", return_value=self.tmp.name)
+        self._cwd_patcher.start()
+
+    def tearDown(self):
+        self._cwd_patcher.stop()
+        self.tmp.cleanup()
+
+    def test_github_remote_injects_token(self):
+        """Legitimate GitHub remote must get Authorization header."""
+        server_info = {
+            "name": "github-mcp-server",
+            "remotes": [
+                {"url": "https://api.github.com/v1", "transport_type": "http"},
+            ],
+        }
+        with patch("apm_cli.adapters.client.cursor.GitHubTokenManager") as mock_tm:
+            mock_tm.return_value.get_token_for_purpose.return_value = "test-tok"
+            config = self.adapter._format_server_config(server_info)
+        self.assertEqual(config.get("headers", {}).get("Authorization"), "Bearer test-tok")
+
+    def test_non_github_remote_no_token(self):
+        """Non-GitHub remote must NOT get Authorization header."""
+        server_info = {
+            "name": "my-custom-server",
+            "remotes": [
+                {"url": "https://evil.example.com/v1", "transport_type": "http"},
+            ],
+        }
+        config = self.adapter._format_server_config(server_info)
+        self.assertNotIn("Authorization", config.get("headers", {}))
+
+    def test_registry_header_cannot_override_github_token(self):
+        """Registry-supplied Authorization must not clobber injected GitHub token."""
+        server_info = {
+            "name": "github-mcp-server",
+            "remotes": [
+                {
+                    "url": "https://api.github.com/v1",
+                    "transport_type": "http",
+                    "headers": [
+                        {"name": "Authorization", "value": "Bearer evil-token"},
+                    ],
+                },
+            ],
+        }
+        with patch("apm_cli.adapters.client.cursor.GitHubTokenManager") as mock_tm:
+            mock_tm.return_value.get_token_for_purpose.return_value = "legit-tok"
+            config = self.adapter._format_server_config(server_info)
+        self.assertEqual(config["headers"]["Authorization"], "Bearer legit-tok")
+
+    def test_unsupported_packages_raises_valueerror(self):
+        """When _select_best_package returns None, raise ValueError instead of silent {}."""
+        server_info = {
+            "name": "weird-server",
+            "packages": [
+                {"registry_name": "unsupported-registry", "name": "pkg"},
+            ],
+        }
+        with patch.object(self.adapter, "_select_best_package", return_value=None):
+            with self.assertRaises(ValueError) as ctx:
+                self.adapter._format_server_config(server_info)
+        self.assertIn("No supported package type", str(ctx.exception))
+
+
 if __name__ == "__main__":
     unittest.main()