Install one MCP client channel per environment, then choose Cursor, VS Code, or GitHub Copilot as a deployment profile of that same channel. Those editors are not separate products. Each profile uses the same Runtime MCP connection and real-user OAuth.
Users state a business goal in the editor. AI Fabrix Role Assistants return a governed result, question, or completed outcome. The editor does not execute enterprise work or grant authority. See Conversation-first work and Assistant channels.
Prerequisites
- Deliver assistant channels hub read
aifabrix loginand developer workstation ready- Permission to create or update Integration Clients on External Access
- Runtime MCP reachable so the editor can discover OAuth
Where it lives
| Artifact | Location |
|---|---|
| Channel package | Builder output under the MCP client channel after channel add |
| OAuth client | External Access Integration Client for the chosen profile (miso-cursor or miso-vscode) |
| Cursor profile | /miso/external-access/oauth2-profiles/miso-cursor |
| VS Code / GitHub Copilot profile | /miso/external-access/oauth2-profiles/miso-vscode |
| Editor config | The editor MCP config file (Cursor mcp.json, VS Code MCP config) |
| Secrets | OAuth in the editor — no static API key in the package |
One MCP client install serves many Role Assistants. GitHub Copilot uses the VS Code Integration Client. Builder writes the Runtime MCP URL into the editor config; it does not rotate the client secret.
How to set
aifabrix channel add mcp-client --target cursor --name "Onni"
aifabrix channel add mcp-client --target vscode --name "Onni"
aifabrix channel add mcp-client --target github-copilot --name "Onni"
--profile is an alias for --target. Omit the channel in a terminal to choose MCP client and then the editor profile interactively. --name is required when the target is specified.
Builder scaffolds and uploads the MCP client system when needed, validates Runtime and OAuth, creates or reuses the Integration Client, and merges the Runtime MCP URL into the editor config. --force refreshes local files and re-uploads without rotating secrets. --dry-run generates artifacts only.
When ready, Builder prints Validating, Runtime: Deployed, and OAuth: Connected. Remaining step:
- Reload the editor.
- Sign in with your user account when the editor starts OAuth.
If OAuth is not ready, open the profile for that editor, enable it, and confirm the loopback callback is registered. Then run the same command again. Do not paste a static API key. Admin completes Connect assistant channels after the editor is connected.
Defaults and examples
| Setting | Typical value |
|---|---|
| Target key | mcp-client |
--target |
cursor, vscode, or github-copilot |
--name |
Customer-visible brand (for example Onni) |
| Server URL | Runtime MCP URL from Builder |
| Authentication | OAuth with the profile client id (miso-cursor or miso-vscode) |
| Product law | One MCP client channel per environment; editor choice is a profile |
| Remaining step | Reload the editor, then sign in |
Validate
aifabrix channel add mcp-client --target cursor --name "Onni" --probe
A successful AI Fabrix probe does not replace reload and user sign-in in the editor. Confirm Runtime MCP is reachable, the Integration Client exists, and the editor config has the Runtime MCP URL. No plaintext secrets belong in generated artifacts.
Common mistakes
| Mistake | Fix |
|---|---|
Missing --target |
Pass cursor, vscode, or github-copilot |
| Cursor profile disabled | Enable Cursor at /miso/external-access/oauth2-profiles/miso-cursor |
| VS Code profile disabled | Enable VS Code at /miso/external-access/oauth2-profiles/miso-vscode |
| Loopback callback missing | Add the editor redirect URI on that profile, then re-run channel add |
| Pasting an API key into the editor | Use OAuth discovered from Runtime |
| Treating Cursor as a different product | Same MCP client channel; profile is deployment config |
| One connection per Assistant | Single channel; many Assistants |
| Skipping reload | Remaining step is reload, then sign in |
Limits
Editor reload and the OAuth sign-in prompt remain on the operator machine. Builder does not write laptop MCP config from the Builder HTTP API. Loopback HTTP callbacks are required for desktop editors; if the identity provider rejects them, fix that identity configuration rather than falling back to API keys.