.cursor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .cursor (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
pd-mcpBasic MCP server for agentic interaction with vanilla Pure Data.
This project is intentionally shaped after the Max/MSP MCP workflow described in the ISMIR 2025 late-breaking demo paper and the associated Max reference implementation, but adapted to what is practical in plain vanilla Pd:
The system has two parts:
5000 and forwards dynamic patching messages into a managed subpatch canvas.Instead of trying to delete or mutate arbitrary objects inside Pd one-at-a-time, the server updates its graph model and resynchronizes the target canvas by sending:
clearThat tradeoff is deliberate. It is simpler and more reliable in vanilla Pd, while still feeling agentic from the MCP client side.
list_pd_objectssearch_pd_objectsget_pd_object_docget_patch_stateadd_pd_objectremove_pd_objectconnect_pd_objectsdisconnect_pd_objectsset_object_textmove_pd_objectclear_patchsync_patchset_dspsend_bang_to_objectsend_message_to_objectset_numbersrc/pd_mcp/server.py: MCP tool definitionssrc/pd_mcp/model.py: in-memory patch graph and Pd index layoutsrc/pd_mcp/bridge.py: UDP FUDI bridge to Pdsrc/pd_mcp/pd_docs.json: small bundled docs set for common vanilla objectspd/pd_mcp_bridge.pd: bridge patch to open in Pure DataUsing uv:
uv venv
source .venv/bin/activate
uv pip install -e .Or with pip:
python -m venv .venv
source .venv/bin/activate
pip install -e .pd/pd_mcp_bridge.pd in vanilla Pure Data.python main.pyEnvironment variables:
PD_MCP_HOST defaults to 127.0.0.1PD_MCP_PORT defaults to 5000Add something like this to your MCP config:
{
"mcpServers": {
"pd-mcp": {
"command": "/bin/zsh",
"args": [
"-lc",
"cd /Users/chrisdonahue/Code/pd-mcp && source .venv/bin/activate && python main.py"
]
}
}
}add_pd_object a few times to create obj, msg, text, or atom boxes.connect_pd_objects to wire them.controllable=true on add_pd_object when you want runtime tools like send_message_to_object, send_bang_to_object, or set_number.get_patch_state whenever the agent needs a reliable snapshot.Example object boxes:
box_type="obj", text="osc~ 440"box_type="obj", text="*~ 0.1"box_type="obj", text="dac~"box_type="msg", text="440"box_type="floatatom"box_type="obj", text="line~", controllable=trueThe Max paper emphasizes two ideas:
This server keeps those properties while using a safer Pd backend than the nascent Pd MCP implementations that mutate Pd more directly.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.