Cursor Sdk Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Cursor Sdk Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that lets MCP clients such as Claude Code invoke the Cursor SDK and use Cursor Agent capabilities as tools for local and cloud coding workflows.
The server speaks MCP over stdio and exposes these tools:
| Tool | Description |
|---|---|
cursor_whoami | Verify the configured Cursor API key and return the authenticated identity. |
cursor_list_models | List the Cursor models available to the account. |
cursor_run_agent | Compatibility alias for a local Cursor Agent run against one cwd. |
cursor_run_local_agent | Run a local Cursor Agent against one or more working directories with optional Cursor MCP settings, inline MCP servers, subagents, sandboxing, and auto-review. |
cursor_run_cloud_agent | Run a Cursor Cloud Agent in a Cursor-hosted or self-hosted environment, optionally cloning repos and creating PRs. |
cursor_follow_up | Continue a previous agent conversation by agentId. |
cursor_get_agent | Fetch agent metadata. |
cursor_list_runs | List runs for an agent. |
cursor_get_run | Fetch one run by runId. |
cursor_cancel_run | Cancel one run by runId. |
cursor_list_artifacts | List artifacts produced by an agent. |
cursor_download_artifact | Download an artifact as base64 content. |
Under the hood it uses @cursor/sdk's local and cloud runtimes. Local agents read/write files on disk from this Node process. Cloud agents run in Cursor-hosted or self-hosted environments and can use Cursor account/team MCP configuration from cursor.com/agents.
@cursor/sdk).(service account key).
npm install
npm run buildSet your API key (see .env.example):
export CURSOR_API_KEY="your-cursor-api-key"
# Optional: default model id used when a tool call omits one (default: "auto")
export CURSOR_MCP_DEFAULT_MODEL="auto"Register the server with Claude Code (stdio):
claude mcp add cursor-sdk -- node /absolute/path/to/cursor-sdk-mcp/dist/index.jsOr add it to your MCP client config manually:
{
"mcpServers": {
"cursor-sdk": {
"command": "node",
"args": ["/absolute/path/to/cursor-sdk-mcp/dist/index.js"],
"env": { "CURSOR_API_KEY": "your-cursor-api-key" }
}
}
}Then ask Claude Code to, for example, "use the cursor agent to refactor src/auth.ts", and it will call cursor_run_local_agent or the compatibility cursor_run_agent.
Use cursor_run_local_agent when the agent should work in local directories:
{
"prompt": "Refactor src/server.ts to split schemas into src/schemas.ts and run tests.",
"cwd": "/absolute/path/to/repo",
"model": "auto",
"mode": "agent",
"settingSources": ["project", "user", "plugins"],
"autoReview": true
}settingSources controls which Cursor MCP/settings layers the local runtime loads from disk. You can also pass inline mcpServers, agents, and sandboxOptions for one-off tool wiring and safety. For local cursor_follow_up, lifecycle, and artifact calls, pass the same cwd used to create the agent so the SDK can find persisted local agent state.
Use cursor_run_cloud_agent when the agent should run in Cursor Cloud:
{
"prompt": "Add tests for the auth middleware and open a PR.",
"repos": [{ "url": "https://github.com/your-org/your-repo", "startingRef": "main" }],
"model": "auto",
"autoCreatePR": true
}repos can be omitted for an empty workspace or a named cloud environment. Cloud agents can use inline MCP plus Cursor account/team MCP configured at cursor.com/agents. Use the lifecycle tools to inspect runs, cancel work, and fetch artifacts.
settingSources includes project, user, or plugin settings.cwd; cloud stdio MCP servers must not include cwd.cursor.com/agents..cursor/skills/, .agents/skills/, ~/.cursor/skills/, or~/.agents/skills/.
this MCP server.
npm run dev # run from source with hot reload (tsx)
npm run typecheck # type-check only
npm run lint # eslint
npm test # integration tests (fake Cursor backend, no network)
npm run demo # spawn the built server over stdio and call its tools
RUN_AGENT=1 npm run demo # additionally run a real Cursor Agent (needs CURSOR_API_KEY)src/cursor.ts — CursorService interface + CursorSdkService (the @cursor/sdk wrapper).src/server.ts — builds the McpServer and registers the tools. Decoupled from the SDK viaCursorService so tests can inject a fake backend.
src/index.ts — entry point; wires the real service to a StdioServerTransport.tests/server.test.ts — connects an in-memory MCP client to the server and exercises every tool.examples/demo-client.ts — end-to-end demo over a real stdio transport.MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.