DEV Community

Edison Flores
Edison Flores

Posted on

How to add trust verification to Cursor's MCP servers in 5 minutes

#cursor #mcp #aiagents #security

How to add trust verification to Cursor's MCP servers in 5 minutes

Cursor uses MCP servers to extend its capabilities. But when Cursor loads an MCP server, how do you know it's trustworthy?

The problem

Cursor loads MCP servers from the registry. No verification of:

  • Who published the server
  • Whether it reads your .env or .aws/credentials
  • Whether it makes undocumented network calls
  • Whether it spawns shell processes

We scanned 9,248 MCP servers: 0.3% try to read credential files, 11% have undocumented network egress.

The solution 

npm install @marketnow/trust-gateway
Enter fullscreen mode Exit fullscreen mode 
import { createPreExecFilter } from '@marketnow/trust-gateway';

const filter = createPreExecFilter({
  allowHosts: ['api.github.com'],
  denyActions: ['shell_exec', 'rm_rf'],
  logSink: (event) => auditLog.append(event),
});

const safeServer = filter.wrap(cursorServer);
Enter fullscreen mode Exit fullscreen mode

Blocks .env reads, rm -rf, shell spawns. Logs to Merkle tree. 100% compatible with Cursor.

Repo: https://github.com/alicelabs-llc/universal-trust-adapter
Live API: https://www.marketnow.site/api/trust

— Edison Flores, AliceLabs LLC

Top comments (0)