Cursor Security

Agentic AI security — identity, least agency, audit, and containment
for systems that act, not only answer.

TOC · Security MCP · Wiki · Manifest · ISMS · Library · MCP · Sources · Brand

_{Author Gürkan Fikret Günak · Cursor Ambassador · Website · @gurkandev}

@cursor-security/mcp turns your Cursor session into a living security review board. Point the agent at any repository and it scores posture across secrets, client-side, backend/API, dependencies, config/infra, and project hygiene — then returns file-level findings the same chat can fix.

One install. Seven scanners. Twelve MCP tools. CLI + SARIF + /app/scans.
Not a vague checklist — concrete recommendations for React/Next clients, Node/Python APIs, Docker, CI, agents, and supply chain.

Also: CLI + SARIF, .cursor-securityignore, GitHub Action / workflow, ingest API → /app/scans. See docs/github-app.md.

Ask the agent:

• “Run a full security scan on this repo and summarize the top risks.”
• “Check client-side auth token storage and CSP.”
• “Audit backend routes for missing auth and open CORS.”
• “What’s our security score, and what should we fix first?”

npm install
npm run build -w @cursor-security/mcp

Cursor → Settings → MCP (see mcp.json.example):

{
  "mcpServers": {
    "cursor-security": {
      "command": "node",
      "args": ["/ABSOLUTE/PATH/TO/cursor-security/packages/cursor-security-mcp/dist/index.js"]
    }
  }
}

Full tool list and architecture: packages/cursor-security-mcp/README.md.

1. Why this exists
2. Who this is for
3. Security MCP for Cursor
4. Repository structure
5. Quick start
6. Product surface (routes)
7. Wiki — Agentic AI Security
   • Core argument
   • Ten principles (deep)
   • Threat catalog
   • Minimum controls
   • Application threat model (this repo)
   • Auth & channel architecture
   • Library map (masterfabric-next-sec)
   • Compliance / ISMS map
   • Framework mapping
   • Learning paths
8. Scripts
9. Environment variables
10. Brand & naming
11. Sources & further reading
12. Author
13. Contributing / reuse
14. Disclaimer

Most AI security conversation still centers on the model prompt: jailbreaks, system-prompt hardening, output filters. That matters — but it is incomplete.

Agentic systems plan, call tools, write code, open pull requests, move data, spend tokens, and trigger side effects across your estate. Once a model can act, you are no longer shipping a chatbot. You are shipping production software with real blast radius.

Cursor Security is an open teaching + reference monorepo that turns those arguments into:

• a public manifest and guidance site
• a working Next.js control surface (/login → /app)
• a reusable library: masterfabric-next-sec
• a Cursor Security MCP for multi-domain repo audits: @cursor-security/mcp
• an ISMS pack mapped to SOC 2, ISO 27001, and OWASP ASVS L2

Fork it for education, internal playbooks, product hardening, or auditor walkthroughs.

cursor-security/
├── apps/api/                         # Go API (Chi + pgx, Render)
├── apps/web/                         # Next.js product (marketing + /app)
│   ├── src/app/                      # Routes: /, /security, /privacy, /login, /app
│   ├── src/components/               # SiteHeader, SiteFooter, CursorMark, forms
│   ├── public/brand/cursor/          # Official Cursor SVG marks
│   └── public/MANIFEST.md            # Served at /MANIFEST.md
├── packages/masterfabric-next-sec/   # Auth.js + Zod + CSP + rate-limit + audit
├── packages/cursor-security-mcp/     # Cursor MCP: multi-domain repo security audits
├── compliance/                       # ISMS: policies, SoA, matrix, evidence
├── MANIFEST.md                       # Public agentic AI security manifesto
├── docker-compose.yml                # Local Postgres 16
└── .github/workflows/ci.yml          # Install, build, typecheck, lint, audit

Prerequisites

• Node.js 20+
• Docker (for local Postgres) or any Postgres 16+
• Optional: SMTP for real magic-link email (without it, links print to the server console in development)

# 1) Install workspaces
npm install

# 2) Start Postgres (DB name: cursor_security)
docker compose up -d

# 3) Env
cp apps/web/.env.example apps/web/.env.local
# Generate secret: openssl rand -base64 32  → set AUTH_SECRET=

# 4) Build the security package (workspace dependency)
npm run build -w masterfabric-next-sec

# 5) Migrate
npm run db:migrate

# 6) Dev server
npm run dev

Open http://localhost:3000.

If you renamed the DB from an older aegis volume, recreate: docker compose down -v && docker compose up -d.

Footer on public pages: Author + Developed with Cursor (official cube mark) — see site-footer.tsx.

A dense, link-rich knowledge base. Treat this README as the index; treat MANIFEST.md + compliance/ as the syllabus.

1. Chatbots answer. Agents act. Tool use, code execution, and connectors turn text into side effects. See OWASP LLM Top 10 — Excessive Agency.
2. The prompt is not your control plane. Natural language can be ignored, injected, or socially engineered. Enforce authorization in code and gateways (ASVS V4 Access Control).
3. Identity before capability. Every run needs a principal, credentials, and an auditable session — no anonymous production tool use (NIST AI RMF — Govern / Map).
4. Tool trust is zero by default. MCP servers, plugins, and browsers are supply chain. Pin, review, isolate (Model Context Protocol).
5. Containment beats perfection. Assume one run can be compromised; design so it cannot take down the estate (sandbox, egress allowlist, budgets, kill switch).
6. Compliance language already maps. ASVS (how the app is built), SOC 2 (how you operate trust), ISO 27001 (how you manage the system) describe the same disciplines with different paperwork. Our map: control-matrix.md.

Full prose: MANIFEST.md. UI summary: apps/web/src/app/page.tsx.

From MANIFEST.md — the floor before production agents:

Source of truth: compliance/threat-model.md.

Assets: user email/identity, session tokens, org membership/roles, audit logs, AUTH_SECRET / DB credentials, public manifesto.

Trust boundaries: Browser (untrusted) → Server (AuthZ) → Postgres; Server → SMTP; CI/devs → production secrets.

Happy path (short): magic link request (rate limited) → Auth.js verification → DB session cookie → /app/* middleware → Server Actions with requireUser + Zod + org RBAC + audit write.

Educational pattern implemented in this monorepo (not a claim of formal certification):

Browser
  │  POST /api/auth/handshake
  ▼
Barrier cookie + device JWT + pre-auth channel (/api/c/<id>/preflight)
  │  magic link (handshakeId must match barrier)
  ▼
Auth.js session (Postgres)
  │  POST /api/auth/bind
  ▼
Blended JWT (user + device + barrier fingerprint)
  + private channel /api/c/<id>/me
  │
  ▼
verifyChannelAccess — wrong path / device / blend → deny + audit

Session defaults (override via options): 8h absolute max age, 1h sliding update — see package README.

Docs: packages/masterfabric-next-sec/README.md.

Wire-up order (≈15 minutes): headers → Auth.js config → Zod actions → audit writer → rate limiter — step-by-step in the package README.

Index: compliance/README.md.

Auditor navigation (recommended order)

1. scope.md — what is in / out
2. threat-model.md + risk-register.md
3. control-matrix.md — ISO Annex A ↔ SOC 2 TSC ↔ ASVS ↔ code
4. Sample policies/ and evidence/
5. Confirm implementation in linked source paths
6. soa.md — Statement of Applicability

Certification path (operating, not a promise): observation → SOC 2 Type I → Type II (≥3 months evidence) → ISO Stage 1/2 → surveillance. Details in compliance/README.md.

Path A — Engineer (half day)

1. Read Core argument + Ten principles
2. Read MANIFEST.md
3. Quick start → browse /, /security, /login, /app
4. Trace one Server Action: Zod → requireUser → audit
5. Skim package README wire-up
6. Fork CSP or rate-limit into your own app

Path B — AppSec / GRC (one day)

1. compliance/README.md navigation order
2. threat-model.md + risk-register.md
3. Pick 10 rows in control-matrix.md and open the linked files
4. Sample two policies + one evidence template
5. Draft what you would still need for Type II observation in your org

Path C — Ambassador / educator (2 hours)

1. Landing + footer brand marks
2. Explain the five-row “old vs agentic framing” table live
3. Point students at Manifest + Sources
4. Demo magic-link login and audit timeline

CI: .github/workflows/ci.yml — install, build package, typecheck, lint, build web, npm audit.

Template: apps/web/.env.example (.env* is gitignored except the example).

• Product name in this repo: Cursor Security
• Company/product short name: Cursor — not “Cursor AI” or “Cursor Code” (brand guidelines)
• Official SVGs from Ambassador Studio library → apps/web/public/brand/cursor/
• README logos use absolute raw.githubusercontent.com URLs + <picture> / prefers-color-scheme (GitHub-safe inline fill, no CSS classes)
• Brand colors: light fg #26251e / dark fg #edecec (brand tokens)
• Product UI (light page): cube mark in header/hero; footer Developed with Cursor → https://cursor.com
• Full asset table: apps/web/public/brand/cursor/README.md

• Fork for education, internal playbooks, and product hardening.
• Keep attribution to this repo when you republish substantial text from the wiki/manifest.
• When redistributing Cursor logos, follow cursor.com/brand and keep the vendored files’ provenance (brand README).
• When you adapt controls, update your threat model and evidence — do not claim certification from this pack alone.
• Issues and PRs welcome on https://github.com/gurkanfikretgunak/cursor-security

This repository provides educational patterns, mapped controls, and starter policies. It does not replace:

• a CPA firm for SOC 2 attestation
• an accredited certification body for ISO 27001
• counsel-reviewed privacy / security legal language
• a full agent runtime sandbox product (narrative + app controls only where implemented)

Capability should grow only as fast as verification, observability, and human accountability — see the commitment in MANIFEST.md.

_{Developed with Cursor · Author Gürkan Fikret Günak · Cursor Ambassador · cursor-security}