### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

# Problem

When using MCP direct with cursor and in the example GitLab MCP.

It goes in the register, authorize, callback flow.

Thing is that cursor sends a redirect_uri as cursor:// to open the client and when GitLab receives redirect_uri it builds the CSP header based on the redirect_uri.

With pure cursor ``` form-action 'self' https: http: cursor: ```

With LiteLLM as the redirect_uri is the https gateway. ``` form-action 'self' https: http: ```

The problem is that from gitlab it gives a 302 to the litellm, and from it another 302 to cursor://. As the initial GitLab didn't trust on cursor schema chrome blocks it and the auth flow is not completed.

``` Sending form data to 'https://gitlab.com/oauth/authorize' violates the following Content Security Policy directive: "form-action 'self' https: http: https:". The request has been blocked. ```

# Workaround

The workaround we have done internally is to have an extra container to intercept the /callback and when litellm sends 302 to cursor we actually render a 200 and make js manage the redi…