VulX Watch for Cursor

Adds the VulX Watch connector to Cursor: independent security review for AI-built apps. The agent can watch a GitHub repo and ask what the last reading found.

VulX does not write a patch or open a PR.

What you get

• MCP server at https://mcp.vulx.ai/mcp

• A skill so the agent knows when to call Watch

• Commands: watch-repo, security-status

You still need a VulX account. Sign-in happens when Cursor talks to the connector. Free while we build it.

Related MCP server: Code Search, Read & PR Analysis

Install

1. Install VulX Watch from the Cursor Marketplace, or clone this repo into ~/.cursor/plugins/local and restart Cursor.

2. Complete the VulX sign-in prompt.

3. Ask: Watch my repo owner/name with VulX. Then: What did VulX find?

If OAuth does not finish inside Cursor, add the same URL as a custom connector: https://mcp.vulx.ai/mcp. Human page: https://vulx.ai/connect

What it will not do

• Patch your app or open a merge-ready PR

• Log in to your running site or database

• Give a 0–100 score or a “safe to ship”

• Treat a quiet week as an all-clear

It reads committed source. It writes only its own brief (AGENTS.md and CLAUDE.md) when brief delivery is on.

License

MIT