QR codes in Cursor and Copilot

Why an IDE agent needs QR codes at all

Not for the app you are shipping: your code should use a library or the API directly. The IDE agent needs them for the work around the code: test fixtures that must decode to known values, a QR image in a README pointing at the docs or a download, a quick "what does this code in the design PNG contain?", a batch of codes for a demo dataset. Small jobs, constantly, where the cost of setup usually exceeds the job, which is why keyless matters more here than anywhere.

Cursor

~/.cursor/mcp.json (or per-project .cursor/mcp.json):

{ "mcpServers": { "useqr": { "url": "https://useqr.app/api/mcp" } } }

The agent gains the six UseQR tools (generate, typed payloads, decode, verify, batch, size) documented in the tool reference. The one that changes IDE workflows is qr_verify: an agent asked to "make the QR code in the hero section match our brand palette" can rasterise its own output and prove the recoloured code still decodes before committing, instead of shipping a plausible-looking failure.

Copilot in VS Code

Copilot's agent mode reads MCP servers from .vscode/mcp.json, with a servers key:

{ "servers": { "useqr": { "type": "http", "url": "https://useqr.app/api/mcp" } } }

Because the server needs no credential, that file is safe to commit, the whole team and CI inherit the capability with zero onboarding. (Copilot's extension and MCP surface evolves quickly; if your build differs, any MCP-capable client takes the same URL.) Per-surface pages: /for/cursor · /for/copilot.

The no-MCP pattern: the API in a snippet

Most one-off jobs do not need tools. They need one HTTP call the agent can write from memory against the keyless API:

// test fixture: known payload, deterministic bytes
const png = await fetch(
  "https://useqr.app/api/v1/qr?data=fixture-001&size=256"
).then((r) => r.arrayBuffer());

<!-- README badge-style QR linking to the releases page -->
![Download](https://useqr.app/q/https%3A%2F%2Fgithub.com%2Facme%2Fapp%2Freleases.png?s=200)

Determinism is what makes the fixture pattern sound: the same parameters return the same bytes, so snapshot tests do not flake, though for QR specifically, prefer matrix snapshots and decode assertions over PNG byte comparisons. And since responses are immutable-cached, a README image URL costs the reader's browser one fetch a year.

Prompts that work

Concrete asks that these setups handle end to end:

• "Generate tests/fixtures/qr/ with ten codes encoding fixture-000 through -009 as SVG, and a manifest JSON." (batch + files)
• "Decode every PNG under assets/qr/ and check the URLs still return 200." (decode + a loop, the dead-link failure mode is real)
• "Add a QR code to the conference slide in slides.md linking to the repo, sized for scanning off a screen."
• "Verify the styled code in signup-poster.svg decodes; if not, tell me why."

Honest boundaries

The IDE agent generates static codes. Nothing here provides scan analytics or editable destinations. For production code paths, still prefer an in-process library (no network dependency in your build). And treat any QR code an agent draws (rather than obtains from a generator), as decoration until a real decoder has read it back.

FAQ

How do I add an MCP server to Cursor?

Create ~/.cursor/mcp.json (or .cursor/mcp.json in the project) with a mcpServers entry naming the server and its URL. For UseQR that is {"mcpServers":{"useqr":{"url":"https://useqr.app/api/mcp"}}}; keyless, so no env vars.

Does GitHub Copilot support MCP servers?

VS Code's Copilot agent mode reads servers from .vscode/mcp.json using a servers key with type http and a URL. The surface is evolving, so check your version's docs; any MCP-capable client accepts the same UseQR URL.

Is it safe to commit the MCP config to the repo?

For keyless servers like UseQR, yes, the config contains only a public URL, no secret. That is precisely the advantage: the whole team and CI get the capability without a credential-distribution step.

Why would an IDE agent verify QR codes?

Because a styling change can silently break scannability. The qr_verify tool rasterises the agent's output and decodes it with a real decoder, so a recoloured or restyled code is proven to scan before it is committed.