quadratic-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited quadratic-mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This repository packages the hosted Quadratic MCP server as a Cursor plugin. Installing it connects Cursor to Quadratic spreadsheets through the production streamable HTTP MCP endpoint:
{
"mcpServers": {
"quadratic": {
"type": "streamable-http",
"url": "https://mcp.quadratichq.com/mcp"
}
}
}plugins/quadratic-mcp/mcp.json adds the hosted Quadratic MCP server.plugins/quadratic-mcp/rules/ provides light guidance for using Quadratic MCP safely.plugins/quadratic-mcp/skills/ adds an on-demand spreadsheet workflow skill.plugins/quadratic-mcp/assets/logo.svg is the marketplace logo.After installing the plugin in Cursor, open a chat and ask to work with a Quadratic spreadsheet. If you are not authenticated yet, ask Cursor to run the Quadratic MCP auth tool with the login action and complete the device auth flow.
Example prompts:
Validate the plugin manifest and referenced files:
node scripts/validate-template.mjsThe marketplace manifest lives at .cursor-plugin/marketplace.json. The plugin manifest lives at plugins/quadratic-mcp/.cursor-plugin/plugin.json.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.