To connect Cursor to Safeguard, add a server entry with the URL https://mcp.safeguard.sh/mcp to your mcp.json file, then approve the OAuth sign in when Cursor opens Safeguard's page. There is nothing to install and no key to copy. Cursor can then call the Safeguard tools your administrator has enabled.
Pick the file
Cursor reads MCP servers from two places. The file at ~/.cursor/mcp.json applies to all of your projects. A file at .cursor/mcp.json inside a repository applies to that project only.
Use the global file for personal use. Use the project file when you want the whole team to get the same entry. Because the entry holds only a URL, it is safe to commit. It holds no secret unless you choose the key option described below.
The entry
{
"mcpServers": {
"safeguard": {
"url": "https://mcp.safeguard.sh/mcp"
}
}
}
Save the file. Cursor supports OAuth for MCP servers, so on connection it opens Safeguard's sign-in page. Sign in, check the app name and the host the page says the authorization code will be sent to, then click Authorize access.
You need a Safeguard account first. Create one at app.safeguard.sh if you do not have one.
If you used an older URL
Earlier instructions used a Cursor specific address, https://mcp.safeguard.sh/mcp/cursor. It reaches the same server, so an existing entry keeps working. You can switch to the plain address when convenient.
Remove any entry that starts a local bridge with npx or mcp-remote, and remove any SAFEGUARD_API_KEY setting. Safeguard hosts the server, publishes no npm package or local bridge for it, and never reads that variable from your machine.
When you cannot use OAuth
If a setup cannot do the OAuth flow, you can send an MCP key instead. In Safeguard, open Settings, then Developer, and create a key of the type MCP key. Add a headers object to the entry with an Authorization value of Bearer followed by the key.
If you do this in a project file, keep that file out of source control. A key acts as the member who created it, across the whole workspace. Prefer the global file for keys. Our MCP key safety checklist covers the rest.
Check that it worked
Ask Cursor something plain, such as "List my security projects" or "Find critical vulnerabilities." If the tool list is empty or short, the connection is probably fine. A new workspace exposes six read-only tools until an administrator turns on more, covered in why only six tools show up.
If a tool you just enabled does not appear, restart the Cursor session. Many MCP clients fetch the tool list once when a session starts and cache it.
For a quick look at what Safeguard finds without any editor setup, try the free scan at gold.safeguard.sh/scan.
Quick check
Do I need npx or an npm package?
No. The server is hosted at the URL above. Safeguard publishes no package for it.
Global or project file?
Global for personal setups, project when the team should share the entry. Keep any key out of committed files.
Sources
Last reviewed: 19 October 2026.
