Cursor Integration for Mend Code

Overview

Mend.io’s Cursor IDE integration enables developers to verify the security of their AI-generated code within Cursor IDE, offering a seamless real-time security check.

Use Cases

1. Developers can trigger security checks manually while generating code with Cursor AI.

2. Developers can configure auto-triggers for security checks. 

Getting it done

As a first step, make sure you have an application to run security checks on (the application in our example is “vulnerable.js”):

Part 1 - Configure the Mend.io MCP using mcp.json

Within Cursor:

1. Click on “Cursor” or the cogwheel in the top menu.

2. Select “Settings…” and then “Cursor Settings” from the drop down menu.

3. In the new window open the “MCP Tools” tab.

4. Click on the “New MCP Server” button.

5. Cursor will open the mcp.json file.
   Add the following code to it and make sure to specify the correct Mend environment URL:

{
  "mcpServers": {
    "mend-mcp-server": {
      "headers": {
        "X-UserEmail": "<EMAIL>",
        "X-UserKey": "<USER_KEY>"
      },
      "url": "[Mend Environment URL]/mcp"
    }
  }
}

Note:

• Mend Environment URL example: https://saas.mend.io

  • This will translate into the following “url” line in the mcp.json file:
    "url": "https://saas.mend.io/mcp"

• It is recommended to create and specify a service user for this integration.

At this point, the configured Mend.io MCP server will show up in your Cursor Settings:

Note: Cursor will automatically detect the sast-code-analysis tool, which is the tool used to create the security checks for your AI-generated code.

Part 2 - Configure Rules using sast.mdc

In order to automatically run SAST security checks after code is generated in Cursor AI, project rules need to be configured.

Within Cursor:

1. click on “Cursor” in the top menu,

2. then select “Settings…” and then “Cursor Settings” from a drop down menu.

3. In the new window open the “Rules” tab.

4. Within “Project rules” section, click on “Add Rule“

5. Provide the name of the rules file, for example “sast“

6. Copy and paste the rules from the section below

7. Make sure that the Rule Type is set to “Always”

Rule Example

In this example, we’re instructing the tool to run twice (before and after a code change), achieving the goal of running iteratively until the code is secure.

### SAST Security Analysis Rules

1. **Mandatory SAST Check for New Vulnerabilities After Code Generation**
    - After generating any code, you must always run the mend-code-security-assistant tool from mend-mcp-server MCP server on the generated code. This is true for any source code, in any language, weather it is a complete method, or even a fix in existing method.

2. **Analyze and Apply Results**
    - Carefully review the results provided by the mend-code-security-assistant tool from mend-mcp-server MCP server.
    - If the mend-code-security-assistant tool from mend-mcp-server MCP server respose with vulnerability information, adjust the code to remediate this vulnarability and re-try.
    - Do not ask the user if she wants to proceed with a safer alternative, just create a safer alternative and retry.
    - Do not re-try more than once.

3. **Error Handling**
   - If an error occurs while running the mend-code-security-assistant tool from mend-mcp-server MCP server, attempt to run it again with adjusted parameters as needed.

Part 3 - Run Security Checks on your Application

At this stage, you use the Cursor AI chat to continue developing your application.

Please make sure that the “Agent” and not the default “Ask” mode is selected.

For example:

“Add a new endpoint to vulnerable.js that accepts a string and log it into the console”.

The sast-code-analysis tool will run on the application to detect CWEs and sanitize them.