CallLint

Cursor

CallLint support for Cursor by Anysphere. CallLint scans MCP server entries only. Cursor rules and editor settings are not covered. Cloud Agents, background agents, cloud subscriptions and event or timer wakeups (GitHub, Slack, Linear, cron) are not statically observable at all: what starts such an agent is decided in Cursor's cloud, not in a file on disk, so CallLint reports that authority as UNSUPPORTED rather than reading it as SAFE. The same holds for where a Cloud Agent runs and for what it changes when it is done. A Cloud Agent can start with no repository at all and run in a Cursor-managed cloud environment, so there is no config file to read the run out of; and its results can create or change a Cursor Origin repository, expose the live environment to a browser through port forwarding, or publish through a connected Vercel account. None of that leaves deterministic static evidence on this machine, so all of it is UNSUPPORTED too. Reading Cursor's MCP config tells you what one layer of Cursor's authority declares, never that the layers CallLint cannot see are safe.

P0 Auto-detects

Why scan Cursor?

Cursor gives MCP servers shell and filesystem authority inside the repository you have open, and `.cursor/mcp.json` is commonly committed — so a server entry travels to every collaborator who opens the project.

Usage

CallLint can auto-discover and scan Cursor configurations:

calllint scan --agent cursor

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan Cursor specifically:

calllint scan --agent cursor

How to verify it worked

Run it against the project config as well as the user one. A committed `.cursor/mcp.json` is a supply-chain surface: the verdict you want is the one your teammates will inherit.

What CallLint does to Cursor

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for Cursor configurations in:

  • ~/.cursor/mcp.json
  • <project>/.cursor/mcp.json

Authority Surfaces

Cursor can grant tools the following authority surfaces:

  • mcp
  • filesystem
  • shell

Distribution

CallLint is available for Cursor through:

  • mcp-stdio (via officialMcpRegistry) — Listing not yet verified
  • cursor-plugin — Awaiting the upstream registry
    Submitted at cursor.com/marketplace/publish and awaiting Cursor's review (reported by the maintainer 2026-08-26). Cursor's intake is a private form review rather than a PR, so no submissionUrl exists to record — the one structural difference from cline/cline-marketplace-pr. The date is the day the manifests Cursor reads landed (65eb719, 2026-08-25), which is the earliest the act could have succeeded: a lower bound on an act reported the next day, not an observed timestamp. Do not resubmit; a duplicate submission is the harm this record exists to prevent.

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for Cursor today. Anything not listed there is not claimed.

Official Sources

Coverage Boundary

CallLint scans MCP server entries only. Cursor rules and editor settings are not covered. Cloud Agents, background agents, cloud subscriptions and event or timer wakeups (GitHub, Slack, Linear, cron) are not statically observable at all: what starts such an agent is decided in Cursor's cloud, not in a file on disk, so CallLint reports that authority as UNSUPPORTED rather than reading it as SAFE. The same holds for where a Cloud Agent runs and for what it changes when it is done. A Cloud Agent can start with no repository at all and run in a Cursor-managed cloud environment, so there is no config file to read the run out of; and its results can create or change a Cursor Origin repository, expose the live environment to a browser through port forwarding, or publish through a connected Vercel account. None of that leaves deterministic static evidence on this machine, so all of it is UNSUPPORTED too. Reading Cursor's MCP config tells you what one layer of Cursor's authority declares, never that the layers CallLint cannot see are safe.