Cognium Labs
Home/Docs/Cursor MCP
Tutorial 03

Give Cursor deterministic security tools.

Connect the public @cognium/mcp-server package so Cursor can call the same local analysis engine as the CLI.

About 10 minutesCursorNode.js 20.19+
Step 1

Add the MCP server

Create .cursor/mcp.json in the project for a repository-scoped setup, or ~/.cursor/mcp.json for a global setup.

.cursor/mcp.jsonjson
{
  "mcpServers": {
    "cognium": {
      "command": "npx",
      "args": ["-y", "@cognium/mcp-server"]
    }
  }
}

The unversioned package name resolves to the latest public npm release.

Step 2

Reload and verify

Reload Cursor or refresh MCP servers in settings. Confirm that cognium is connected and that its eleven tools are visible:

  • scan, taint_paths, and explain_finding
  • list_entry_points, list_reachable_sinks, and attack_surface_summary
  • check_sanitizer, describe_sink, and describe_source
  • find_similar and refresh
Step 3

Run the first agent scan

Ask Cursor to call the tool explicitly so the response is grounded in engine output.

example promptstext
Use the cognium scan tool on ./src and summarize critical and high findings.

Call attack_surface_summary and list the top attacker-reachable entry points.

For finding ID X, call explain_finding, then check_sanitizer before proposing a fix.
Step 4

Use the tool sequence deliberately

A practical review sequence is scan → attack_surface_summary → explain_finding → check_sanitizer → find_similar.

See the public MCP server documentation for the package contract and client configuration.

Repeat from the CLI All tutorials