Audit Cursor mcp.json before enabling tools.

Project config versus user config

A project-level MCP configuration can arrive with a cloned repository and may be reviewed differently from a personal configuration. Check repository changes carefully and avoid enabling unfamiliar servers automatically. A user-level server may have broader reach across workspaces.

Five checks before activation

• Is the package or binary from the expected publisher?
• Is the exact version pinned?
• Does the config contain a real credential?
• Does a filesystem or command tool reach beyond this project?
• Does the remote endpoint use HTTPS and scoped authentication?

Safer project scope

{
  "mcpServers": {
    "docs": {
      "command": "npx",
      "args": ["@example/docs-mcp@1.4.2", "--root", "./docs"]
    }
  }
}

Exact versioning and a narrow relative path reduce visible risk, but they do not prove the package is trustworthy. Review source and runtime capabilities as separate steps.

After the config passes

Inspect the tools Cursor receives from the server. Look for broad file write, shell, browser, network, email, repository, and deployment capabilities. Disable anything unrelated to the intended workflow and review again after dependency updates.