Trustabl for Cursor

Bring Trustabl — the static reliability & safety scanner for AI-agent codebases — into Cursor.

The plugin adds an MCP server whose tools the Cursor agent can call. Ask it to "scan this repo with Trustabl" and it inventories your agents, tools, and MCP servers, flags risky patterns with severities, scores production readiness, and writes a SARIF 2.1.0 report into your workspace so the findings render in a SARIF viewer as well as in chat.

Detects Claude Agent SDK, OpenAI Agents SDK, Google ADK, LangChain, CrewAI, Pydantic AI, Vercel AI, AutoGen, MCP servers, and Claude subagents & skills.

How it works

flowchart TD
    U["You<br/>“scan this repo with Trustabl”"] --> A["Cursor Agent"]
    A -->|"MCP tool call<br/>trustabl_scan"| S["Trustabl MCP server<br/>npx · stdio"]

    S --> B{"trustabl binary<br/>available?"}
    B -->|"on PATH"| SCAN
    B -->|"no"| D["Download release asset<br/>verify sha256<br/>cache in ~/.trustabl-cursor"]
    D --> SCAN["trustabl scan<br/>single pass · sarif-out · json-out"]

    SCAN --> R["Report table · readiness score<br/>severity breakdown · findings"]
    R -->|"returned in the tool result"| A
    R -->|"written to disk"| F["trustabl.sarif<br/>trustabl.json<br/>trustabl-report.txt"]
    F --> V["SARIF viewer /<br/>Problems panel"]
    A --> U

    classDef plugin fill:#1f6feb,stroke:#1f6feb,color:#fff
    classDef output fill:#238636,stroke:#238636,color:#fff
    class S,SCAN plugin
    class F,V,R output

A failed download or a checksum mismatch aborts the scan — the plugin never runs an unverified binary.

Install

Three ways, same result. Pick one.

1. From the Cursor plugin directory

1. In Cursor, open Customize (Settings → the "Plugins, MCPs, Skills and Rules have moved to Customize" banner links there too).
2. Browse Marketplace → search Trustabl → Install.

2. From this repo, as a local plugin

Clone it into Cursor's local plugin folder and restart Cursor:

git clone https://github.com/trustabl/trustabl-cursor.git
# macOS / Linux
cp -r trustabl-cursor ~/.cursor/plugins/local/
# Windows (PowerShell)
Copy-Item -Recurse trustabl-cursor "$HOME\.cursor\plugins\local\"

Cursor auto-detects .cursor-plugin/plugin.json and mcp.json. No build step and no npm install — the server ships pre-bundled.

3. As a plain MCP server

Registers the server directly, bypassing the plugin system entirely. Clone the repo anywhere, then add it to ~/.cursor/mcp.json (global) or <your-project>/.cursor/mcp.json (that project only), using the absolute path to the clone:

{
  "mcpServers": {
    "trustabl": {
      "command": "node",
      "args": ["/absolute/path/to/trustabl-cursor/dist/index.js"]
    }
  }
}

On Windows use forward slashes: C:/Users/you/trustabl-cursor/dist/index.js. Restart Cursor.

The same block works in any MCP client — Claude Code, Windsurf, VS Code — since it is a standard stdio MCP server. Set TRUSTABL_VERSION / GITHUB_TOKEN under an "env" key here rather than in Cursor's plugin settings.

Check it's working

Customize → Plugins → Trustabl Cursor. Under MCPs you should see:

trustabl  ● 2 tools enabled

A green dot means the server started. If it's red, open Configure → Show Output for the error (see Troubleshooting). With method 3 the server appears under Customize → MCPs instead of under a plugin.

Nothing else to set up: the trustabl binary is downloaded and sha256-verified on first scan, then cached in ~/.trustabl-cursor/.

Using it in chat

Open the repo you want

... View full README on GitHub