Stunt Double MCP server

Stunt Double MCP Server

Deploy AI user personas to validate user journeys at scale. Find UX friction before real users do.

Stunt Double deploys AI agents with realistic user personas to validate user journeys at scale. Create actors, run automated workflows and checklists against any web app, and surface friction points before real users encounter them. Integrates with Claude, Linear, GitHub, and Slack.

This repository

This repo holds plugin and MCP configuration (.cursor-plugin/plugin.json, root mcp.json, server.json), plus skills, agents, and Cursor rules. There is no package.json and no runnable server here — the MCP endpoint is hosted at https://app.stuntdouble.io/api/mcp from the main Stunt Double codebase. See CONTRIBUTING.md for how to validate edits and avoid confusing this folder with a Node package.

Quick Start

Claude Code

claude mcp add --transport http stuntdouble https://app.stuntdouble.io/api/mcp

Claude Desktop

Go to Settings → Connectors → Add and paste:

https://app.stuntdouble.io/api/mcp

Cursor / Windsurf

Add the mcpServers block below to an MCP config file:

• Project-local (recommended for this repo clone): .cursor/mcp.json at the root of your project.
• Global (all projects): ~/.cursor/mcp.json on macOS/Linux (see Cursor MCP docs for your OS).

{
  "mcpServers": {
    "stuntdouble": {
      "url": "https://app.stuntdouble.io/api/mcp"
    }
  }
}

Use only url for remote servers (Streamable HTTP is negotiated automatically). Extra keys such as "type": "streamable-http" are not part of Cursor's documented mcp.json shape and can break plugin validation.

Cursor marketplace (one-click install) expects a plugin layout: .cursor-plugin/plugin.json plus root mcp.json. Those files are in this repo. The plugin logo path is assets/logo.png (bundled in this repository). The server.json file is the separate MCP registry manifest for mcp-publisher and directory listings; Cursor's installer does not use it.

Authentication

Authentication is handled automatically via OAuth 2.1 with PKCE. The first time your AI client connects, a browser window will open for you to sign in and authorise access to your Stunt Double account. No API keys or tokens required.

For Cursor, the OAuth redirect URI is fixed to cursor://anysphere.cursor-mcp/oauth/callback (docs).

What a connection can reach

The server acts as you, never more. Every tool resolves the workspace it is being asked about and checks your membership of it before doing anything, so a connection reaches exactly the workspaces list_workspaces returns for you, and an archived workspace reaches nothing. A workspace you are not a member of answers the same way one that does not exist does: "not found".

That holds for ids too, not just the workspace_id you pass. A tool that takes another object's id (a checklist for an automation step, an actor for an interview participant) checks that object belongs to the same workspace before storing or running it, and refuses with "not found in this workspace" otherwise. Refusals never say which workspace an id does belong to.

Scopes narrow this further, never widen it. The consent screen names what the connection asked for, and a token granted mcp:read is not shown the write or run tools at all: they are absent from tools/list rather than present and failing.

Shortened. The full README is on GitHub.