Allows agents to watch a GitHub repository for security review findings, check its security status, and retrieve results from the last VulX reading.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@VulX Watch what did the last security review find on my repo?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Adds the VulX Watch connector to Cursor: independent security review for AI-built apps. The agent can watch a GitHub repo and ask what the last reading found.
VulX does not write a patch or open a PR.
MCP server at https://mcp.vulx.ai/mcp
A skill so the agent knows when to call Watch
Commands: watch-repo, security-status
You still need a VulX account. Sign-in happens when Cursor talks to the connector. Free while we build it.
Related MCP server: Git MCP Server
Install VulX Watch from the Cursor Marketplace, or clone this repo
into ~/.cursor/plugins/local and restart Cursor.
Complete the VulX sign-in prompt.
Ask: Watch my repo owner/name with VulX. Then: What did VulX find?
If OAuth does not finish inside Cursor, add the same URL as a custom
connector: https://mcp.vulx.ai/mcp. Human page: https://vulx.ai/connect
Patch your app or open a merge-ready PR
Log in to your running site or database
Give a 0–100 score or a “safe to ship”
Treat a quiet week as an all-clear
It reads committed source. It writes only its own brief (AGENTS.md and
CLAUDE.md) when brief delivery is on.
MIT
This server cannot be deployed
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
Read-only smart-contract security intelligence for autonomous agents.
