Cursor

Cursor supports remote HTTP MCP servers directly. One file, one entry.

Add it

Global (recommended)

Create or edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "vulnetix": {
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey <orgId>:<hex>"
      }
    }
  }
}

Available in every project, and the key lives outside every repository.

Project

Create .cursor/mcp.json in the repository root:

{
  "mcpServers": {
    "vulnetix": {
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey ${VULNETIX_ORG}:${VULNETIX_KEY}"
      }
    }
  }
}

Important .cursor/mcp.json is an ordinary file in your working tree. git add -A will stage it without comment. Use ${VAR} as above, or add .cursor/mcp.json to .gitignore. If a literal key has already been pushed, rotate it and treat the old one as public.

Restart Cursor. Then Settings → Cursor Settings → MCP should show vulnetix with a green dot and a tool count.

Confirm it works

Open the Agent panel (⌘I / Ctrl+I). MCP tools are available in Agent mode only, not in inline edit or plain chat.

Check whether CVE-2021-44228 is in the CISA KEV catalogue and what the due date was.

Cursor asks before running a tool the first time. Approve it, and the answer comes back with the KEV due date, EPSS score and SSVC decision.

Worth knowing

Tool limit. Cursor caps how many tools it sends to the model at once (historically around 40–50 across all servers). With Vulnetix contributing 31, adding several more servers can push you over and tools start being silently dropped. If a tool the agent should have used goes unused, check your total first, because the symptom looks like a broken server without being one.

Agent mode only. MCP tools are not available in ⌘K inline edit.

Restart, do not reload. Cursor reads mcp.json at launch.

Troubleshooting

Red dot in the MCP panel. Almost always JSON: a trailing comma, a smart quote from a copy-paste, or a missing brace. Run the file through jq ..

Green dot but no tools used. Check you are in Agent mode, and check the tool cap above.

Every tool returns 401. The header needs both halves of the key: ApiKey <orgId>:<hex>, not the hex alone.

${VULNETIX_KEY} appears literally in results. Cursor did not inherit the variable. Launching Cursor from the desktop instead of a terminal often means it never saw your shell profile. Use the global config with a literal key in ~/.cursor/mcp.json, which is outside git anyway.