How to connect a security MCP server to Cursor and VS Code

AI coding agents write code faster than anyone can review it, and they are poor judges of their own output. Asking the same model to check its change gives you the same opinion twice. A security scanner exposed over the Model Context Protocol (MCP) gives the agent something better: a tool whose answer does not depend on how the question was phrased.

This post shows the exact configuration for Cursor, VS Code and Claude Code, using Vulkro's MCP server as the example, and then covers the part most setup guides skip: deciding which servers deserve a place in that file at all.

#What an MCP config actually does

An MCP config is a list of programs your editor will start on your behalf, with your user's permissions. For a local server the transport is stdio: the editor launches the command, writes JSON-RPC requests to its standard input and reads responses from its standard output. Every tool description the server publishes, and every result it returns, goes straight into the model's context.

Keep that picture in mind for the rest of this post. Adding a server is closer to adding a CI step than installing a plugin.

#Cursor

Cursor reads MCP servers from .cursor/mcp.json in the project, or from ~/.cursor/mcp.json for every project. The top-level key is mcpServers:

{
  "mcpServers": {
    "vulkro": {
      "command": "vulkro",
      "args": ["mcp", "serve"]
    }
  }
}

Restart Cursor after editing. The project-level file is the better choice for a team, because it is reviewed in pull requests like any other code.

#VS Code

VS Code uses a different shape. Its workspace file is .vscode/mcp.json, the top-level key is servers, and each entry declares its transport with type:

{
  "servers": {
    "vulkro": {
      "type": "stdio",
      "command": "vulkro",
      "args": ["mcp", "serve"]
    }
  }
}

The difference between mcpServers and servers is the most common reason a config copied from a Cursor guide silently does nothing in VS Code.

If you use the Vulkro VS Code extension, you can skip this step: the extension registers vulkro mcp serve for the editor's agent mode itself. Add the file by hand only if you want the entry pinned in the repository.

#Claude Code

Claude Code registers servers from the command line:

claude mcp add vulkro -- vulkro mcp serve

Everything after -- is the command to launch. To share the entry with your team, register it with project scope, which writes a .mcp.json file at the repository root that you can commit.

#What the agent gets

vulkro mcp serve exposes a set of deterministic tools. None of them calls a model, and none writes to your repository. The ones an agent uses most:

The loop that works is short. The agent edits, calls scan_diff, calls prove on anything reported so the fix targets the real attack path, then calls verify_fix and only applies a change that comes back fixed. The full list is in the vulkro mcp serve docs.

#Deciding what to trust

A scanner in your agent's toolbox only helps if the rest of the toolbox is not working against you. Ask four questions of every server you add, including ours.

#Where does the code go?

A security server sees your source. Find out whether it sends that source anywhere. With Vulkro, source code, file paths and findings stay on the machine, and the scan engine makes no network call. A licence heartbeat runs in the background (usage counts and command names, never code); setting VULKRO_OFFLINE=1 in the server's environment turns off every network call, and vulkro mcp serve honours it:

{
  "mcpServers": {
    "vulkro": {
      "command": "vulkro",
      "args": ["mcp", "serve"],
      "env": { "VULKRO_OFFLINE": "1" }
    }
  }
}

Secrets found during a scan are masked in MCP responses by default, so a hard-coded key in your code is not pasted back into the model's context in full.

#Is the version pinned?

An entry like npx -y some-server resolves to whatever the registry serves on the day the editor starts, so the server you reviewed is not necessarily the one that runs. Pin package servers to an exact version. For a binary such as vulkro, install a specific release and point command at its absolute path if you want to be certain a PATH change cannot swap it; vulkro --version confirms what is running.

#What can it reach?

A filesystem server rooted at / or your home directory hands the model every file you can read. Scope roots to the project. Keep credentials out of the env block and reference environment variables instead, because these files get copied between machines and committed.

#Who reviews changes to the config?

Treat .cursor/mcp.json, .vscode/mcp.json and .mcp.json as code. A pull request that adds a server deserves the same scrutiny as one that adds a CI step, because it is effectively the same thing.

vulkro mcp-audit automates most of this review. It reads the project's .mcp.json and mcp.json plus the known host config locations, and flags unpinned npx / uvx installs, git sources on a mutable ref, over-broad filesystem roots, inline credentials, cleartext endpoints and known compromised releases:

vulkro mcp-audit --require-mcp --fail-on critical,high

--require-mcp makes a missing config an error rather than a quiet pass, which is what you want in CI.

#FAQ

#Why does my MCP config work in Cursor but not in VS Code?

The formats differ. Cursor expects a top-level mcpServers object; VS Code's .vscode/mcp.json expects servers, with a type such as stdio on each entry. Rename the key and add the type.

#Is it safe to let an AI coding agent run an MCP server?

It is as safe as the server and its config. Prefer local stdio servers you can inspect, pin versions, scope filesystem access, keep secrets out of the file, and audit the config in CI. A server that sends your code to a remote service is a data-sharing decision, not just a tooling one.

#Does a security MCP server replace code review?

No. It gives AI coding agents a deterministic check on their own changes, which raises the floor. A person still decides what ships, and an empty result means nothing was found, not that the change is safe.

To try this on your own code, see Vulkro for AI coding agents and start a 14-day trial. Related reading: Audit your MCP configs, then give your agent a scanner and MCP servers are the new attack surface.