Sipflow Cursor Plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Sipflow Cursor Plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
SIP/VoIP/telecom grounding for AI agents. Vendor docs across ~40 stacks, 60+ RFCs, STIR/SHAKEN, trace and config analysis - every answer cites a verbatim source_url.Sipflow is a hosted, read-only Model Context Protocol server. It gives your editor or agent ~20 tools that ground SIP/VoIP answers in a curated corpus instead of training-data recall.
https://mcp.sipflow.dev/mcp (Streamable HTTP)Install Sipflow in Cursor
Or from the Cursor Marketplace. This repo also ships as a Cursor plugin with a bundled Skill and Rule (see What's in this repo below).
~/.cursor/mcp.json{
"mcpServers": {
"sipflow": { "url": "https://mcp.sipflow.dev/mcp" }
}
}.vscode/mcp.json or user settings.json{
"servers": {
"sipflow": {
"type": "http",
"url": "https://mcp.sipflow.dev/mcp"
}
}
}Requires VS Code 1.99+ with the GitHub Copilot extension.
claude_desktop_config.jsonClaude Desktop is stdio-only, so use the mcp-remote shim:
{
"mcpServers": {
"sipflow": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.sipflow.dev/mcp"]
}
}
}claude mcp add --transport http sipflow https://mcp.sipflow.dev/mcp~/.codex/config.toml[mcp_servers.sipflow]
url = "https://mcp.sipflow.dev/mcp"{
"mcpServers": {
"sipflow": { "url": "https://mcp.sipflow.dev/mcp" }
}
}~/.continue/config.yamlmcpServers:
- name: sipflow
transport:
type: streamable-http
url: https://mcp.sipflow.dev/mcp~/.codeium/windsurf/mcp_config.json{
"mcpServers": {
"sipflow": {
"serverUrl": "https://mcp.sipflow.dev/mcp"
}
}
}~/.config/goose/config.yamlextensions:
sipflow:
type: http
uri: https://mcp.sipflow.dev/mcp
enabled: truecurl -sS -X POST https://mcp.sipflow.dev/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'| File / Folder | Marketplace | Purpose |
|---|---|---|
server.json | Official MCP Registry | Canonical server descriptor. PulseMCP auto-ingests from here. |
smithery.yaml | Smithery | Remote HTTP listing. |
.cursor-plugin/plugin.json | Cursor Marketplace | Plugin manifest. |
mcp.json | Cursor plugin auto-discovery | Points the plugin at the remote endpoint. |
skills/sip-debugger/ | Cursor plugin | "When to use Sipflow" playbook surfaced as /sip-debugger. |
rules/sip-grounding.mdc | Cursor plugin | Auto-attaches when editing .pcap, kamailio/opensips/freeswitch/asterisk configs, dialplans, .sdp. |
assets/logo.svg | All | Logo. |
The Cursor-specific files (.cursor-plugin/, mcp.json, skills/, rules/) are silently ignored by non-Cursor marketplaces - they only parse their own manifest.
All tools are read-only. The only outbound IO is dns_diagnose_sip_target (DNS + TLS handshake) and validate_stir_shaken_identity (cert fetch).
Discovery / grounding - search_sip_docs, lookup_response_code, lookup_sip_header
Detection - detect_sip_stack, detect_sip_vendor_from_config
Traces - minimize_sip_trace, render_sip_ladder, sip_ladder_example, lint_sip_request, parse_sip_message, diff_sip_messages
Config review - review_sip_config, webrtc_sip_checklist
SDP - parse_sdp, compare_sdp_offer_answer
STIR/SHAKEN - validate_stir_shaken_identity, stir_attestation_explainer
Telecom - validate_e164_number, troubleshoot_response_code
Network - dns_diagnose_sip_target (rate-limited)
Share hydration - fetch_sipflow_share for sipflow.dev/share/<token> URLs
Resource - sipflow://docs/{vendor}/{id} for a single corpus chunk
SIP.js, JsSIP, FreePBX, 3CX, OpenSER, Twilio, Cisco, ...
Test the plugin locally by symlinking this repo into Cursor's local plugin folder:
ln -s "$PWD" ~/.cursor/plugins/local/sipflowRun Developer: Reload Window in Cursor. You should see:
sipflow server in Settings -> Features -> Model Context Protocolsip-debugger skill under Settings -> Rules (Agent Decides)sip-grounding rule under Settings -> RulesWhen the MCP server changes, bump version in three places to keep registries in sync:
server.json -> Official MCP Registry.cursor-plugin/plugin.json -> Cursor MarketplaceserverInfo.versionThen re-run mcp-publisher publish for the Official Registry. Cursor, Smithery, and Glama auto-track the default branch.
MIT - see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.