.cursor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .cursor (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that audits a project for documentation, rules, skills, and other knowledge artifacts. It compares what exists against a reference concept catalog and produces a prescription plan (cursor-doctor-prescription-plan.md) with frontmatter todos listing missing or incomplete elements. The plan always ends with an Update Artifacts todo so that rules, skills, and docs stay in sync after every session.
Add the server to your project's MCP config (or use it globally via Cursor settings):
Using npx (no local install):
{
"mcpServers": {
"cursor-doctor": {
"command": "npx",
"args": ["-y", "cursor-doctor@latest"]
}
}
}Local development (from this repo):
{
"mcpServers": {
"cursor-doctor": {
"command": "node",
"args": ["/path/to/cursor-doctor/dist/index.js"]
}
}
}Config lives in .cursor/mcp.json (project) or in Cursor’s user MCP configuration.
.cursor/mcp.json as in Installation above).Prompt Cursor to create a skill file for the command "doctor" or "cursor doctor" that:
cursor-doctor-prescription-plan.md is written with frontmatter-style todos in the plan.The repo tracks a skill and rules so the workflow is consistent; see Tracked Cursor artifacts below.
These files are committed in this repo so the doctor command and expectations stay consistent:
| File | Purpose |
|---|---|
| .cursor/skills/cursor-doctor/SKILL.md | Skill for "doctor" / "cursor doctor": calls cursor-doctor-self in planning mode, uses frontmatter todos from the prescription plan. |
| .cursor/rules/cursor-doctor.mdc | Rule applied when editing the prescription plan or rules/skills: use the doctor workflow and complete Update Artifacts. |
| .cursor/rules/required-cursor-doctor-skill.mdc | Rule (always apply): the cursor-doctor skill must exist at .cursor/skills/cursor-doctor/SKILL.md; if missing, recreate it from this README. |
Reference these in your workflow; do not remove them without updating the README.
| Tool | Purpose |
|---|---|
| audit_project | Scans the project for markdown, rules (.mdc), skills (SKILL.md), and config files. Returns paths and summaries for semantic matching, plus a list of gaps (concepts that have no matching artifact). |
| read_document | Returns the full content of a file. Use a path from the audit result to inspect an artifact. |
| generate_prescription | Runs an audit, then writes cursor-doctor-prescription-plan.md to the project root with YAML frontmatter todos (missing/incomplete concepts and the always-final “Update Artifacts” step). |
The server checks for 23 concepts in 6 tiers. Artifacts are matched by file patterns (e.g. README.md, .cursor/rules/*.mdc) and by content signals (keywords in the first lines of a file) so that differently named files can still satisfy a concept.
cursor-doctor-prescription-plan.md has:
title, project, audited_at, health_score, total_concepts, found, missing, incompletetodos: list of id, tier, status (missing | incomplete | found | action), concept, priority, and optionally found_at, details, promptEach todo for a missing or incomplete concept includes a prompt that instructs the AI to create or update the artifact (e.g. by mining the codebase). The artifact-sync todo always has status: action and a prompt to review and update all cursor-doctor artifacts at the end of the session.
npm install
npm run buildThe server runs over stdio; Cursor (or another MCP client) starts it and communicates via stdin/stdout. To run the built server directly:
node dist/index.js(It will wait for JSON-RPC on stdin; normal use is through Cursor’s MCP integration.)
A pre-commit hook (via Husky) bumps the npm package patch version before each commit. The commit you push will therefore include the updated package.json (and package-lock.json). Hooks are installed when you run npm install (the prepare script runs husky). To skip the bump for a single commit, use git commit --no-verify.
npx cursor-doctor)So users can install with npx cursor-doctor@latest, publish the package to npm:
npm login # once, if not already logged in
./publish.sh # builds and runs npm publish
./publish.sh --dry-run # test without publishingTo appear in the Cursor MCP Marketplace so people can discover and install from cursor.store:
cursor-doctor.cursor/mcp.json): {
"mcpServers": {
"cursor-doctor": {
"command": "npx",
"args": ["-y", "cursor-doctor@latest"]
}
}
}Full rules and requirements: cursor.store/rules.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.