This guide adds a SmeltSec-generated MCP server to Cursor on macOS, Windows, and Linux. It covers the two config locations Cursor reads, the CLI commands that scaffold and scan the server, the exact mcp.json block, and how to reload without restarting the editor.
The current CLI package accepts Node.js 22.22.2 through 22.x, 24.15.0 through 24.x, or 26 and later. You also need a Cursor build with MCP support and an OpenAPI or REST spec to turn into MCP tools. Cursor loads MCP servers lazily on first use, so a failing server will not block the editor from starting. The SmeltSec flow records the gate decision and scanner coverage; review skipped checks before using the generated server.
Cursor reads two files. The global file applies to every workspace. The project file overrides for a single workspace. Both use the same schema.
You can also open Settings then MCP inside Cursor; the UI writes to the same file. Create the file if it does not exist with an empty object literal.
The public npm release is 0.1.0. Pin that version so the commands in this guide match your installed CLI. Review its package files and dependencies before installation.
npm install -g @smeltsec/cli@0.1.0 smeltsec --version
If the version check fails, your npm global bin is not on PATH. Run npm config get prefix, add that path plus /bin to your shell rc file, and open a new terminal. On Windows, check that %APPDATA%\npm is on PATH.
smeltsec init interactively creates the project skeleton and asks for an output directory. smeltsec ci evaluates that directory against configured security and quality thresholds.
smeltsec init smeltsec ci ./my-server --output ./my-server/smeltsec-ci.json cd my-server npm run build
The compiled server lives at dist/server.js. Note the absolute path. You will use it in the next step.
Cursor expects the mcpServers key with named entries. Each entry has command, args, and an optional env map. The schema matches Claude Desktop, so you can reuse the same block across clients.
{
"mcpServers": {
"my-server": {
"command": "node",
"args": ["/Users/you/projects/my-server/dist/server.js"],
"env": {
"API_KEY": "sk-..."
}
}
}
}For project-scoped servers, commit .cursor/mcp.json to the repo. Teammates who open the workspace inherit the config. Keep API keys out of the checked-in file; use a .env file or your secrets manager instead.
Open Settings, then MCP. The server row shows a status dot: green means connected, red means the process exited, yellow means loading. Click refresh to kick the process. The tool count column should show a non-zero number after a successful connect.
Inside a chat, type /tools to see every available MCP tool. Your server name appears as a prefix on each tool. If the list is empty, the server crashed after spawn; check the log panel in Settings > MCP.
Click the log button on the server row. Cursor captures stderr from the child process. Nine times out of ten this is a missing env var or a path typo.
The tool list is cached per chat. Start a new chat. If the list is still empty, the server is not calling tools/list during initialization. Run smeltsec test . to confirm the generated code registers tools.
A project-level .cursor/mcp.json shadows the global file. Check the workspace root for a stray file. If both exist, merge them or delete the project file.
Cursor on macOS launches with a minimal PATH that excludes nvm-managed Node. Replace "node" with the absolute path from which node, or install Node via Homebrew which lives at a stable location.
Free tier includes Gate 1 scanning and 5 generations per month.