Cursor MCP Server

The materials explicitly state that no keys or environment variables are required, and there is no indication that API tokens, account credentials, or cloud secrets are needed, so credential exposure appears low.

The materials list no remote endpoints, and the description does not mention cloud sync, external APIs, or telemetry; based on the available facts, no explicit data egress path is shown.

The system checks confirm code-execution capability, and the stated features include linting, formatting, and version control, which typically imply invoking local developer tools or starting related processes. This is a normal but high-privilege capability for this kind of MCP and warrants controlled use.

It claims code browsing, editing, and searching, which implies the ability to read and modify local project files and potentially affect source code, configuration, and version-control-related content. There is no evidence of permissions beyond its stated purpose, but the file access scope itself warrants caution.

A positive factor is that the source repository is public and auditable. However, it comes from a third-party registry, lacks a README, has no declared license, has 0 stars, and shows unknown maintenance status, so trust and upkeep signals are weak. There is no concrete red flag sufficient for a high-risk rating, but the repository contents and dependencies should be reviewed before use.