Cursor

Connect Attestd to Cursor

Cursor reads MCP config from .cursor/mcp.json in your project root (project-level) or from your Cursor user settings (global, applies to all projects). The hosted server at mcp.attestd.io is the recommended option. No Node.js required.

1. Get an API key from the portal.
2. Add the block below to .cursor/mcp.json in your project root.
3. Restart Cursor. Both Attestd tools appear in Cursor's tool list.

{
  "mcpServers": {
    "attestd": {
      "url": "https://mcp.attestd.io/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

Local stdio via npx

If you prefer local execution, use the stdio npm package instead. Requires Node.js 18+.

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

System prompt

Add this to your project .cursorrules or Cursor system prompt settings. Without it, Cursor may have the tool available but not call it unprompted when you discuss a dependency.

You are a security-aware deployment assistant with access to the Attestd MCP server.

Before approving any software dependency, infrastructure component, or package version:
1. Call check_package_vulnerability with the product slug and exact version.
2. Block deployment if riskState is "critical" or "high".
3. Block immediately if activelyExploited is true, regardless of riskState.
4. Block immediately if supplyChainCompromised is true.
5. If outsideCoverage is true, state explicitly that the risk is UNKNOWN. Do not treat it as safe.
6. If patchAvailable is true, include fixedVersion in your recommendation.

Use list_covered_products if you are unsure whether a product slug is supported.

What Cursor does with Attestd

When you ask Cursor about a dependency, “is this package safe to install,” “can I upgrade to this version,” “check my package.json before I push,” Cursor calls check_package_vulnerability with the package name and version. Attestd returns a structured response. Cursor reads risk_state, actively_exploited, and supplyChainCompromised and gives you a direct answer rather than summarizing a CVSS score.

Verify the connection

Ask Cursor to call list_covered_products. It should return the count of supported infrastructure slugs. For a direct server check:

curl https://mcp.attestd.io/health
# → {"status":"ok"}