VulX Watch for Cursor

Adds the VulX Watch connector to Cursor: independent security review for AI-built apps. The agent can watch a GitHub repo and ask what the last reading found.

VulX does not write a patch or open a PR.

What you get

MCP server at https://mcp.vulx.ai/mcp
A skill so the agent knows when to call Watch
Commands: watch-repo, security-status

You still need a VulX account. Sign-in happens when Cursor talks to the connector. Free while we build it.

Install

Install VulX Watch from the Cursor Marketplace, or clone this repo into ~/.cursor/plugins/local and restart Cursor.
Complete the VulX sign-in prompt.
Ask: Watch my repo owner/name with VulX. Then: What did VulX find?

If OAuth does not finish inside Cursor, add the same URL as a custom connector: https://mcp.vulx.ai/mcp. Human page: https://vulx.ai/connect

What it will not do

Patch your app or open a merge-ready PR
Log in to your running site or database
Give a 0–100 score or a “safe to ship”
Treat a quiet week as an all-clear

It reads committed source. It writes only its own brief (AGENTS.md and CLAUDE.md) when brief delivery is on.

License

MIT

Config for your environment

Use the endpoint URL below in your config. No API key — you connect directly.

Tool

Config file: ~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-server": {
      "url": "https://mcp.vulx.ai/mcp"
    }
  }
}

Paste into mcpServers in the config file. Restart Cursor after saving.

VulX Watch