AI SECURITYLABS

Security for Cursor Development: Prove it works

Part 14 of 16

Prove it works

Configuration you haven’t tested may not do what you think, so verify it three ways:

  • Test it live: in a throwaway project with a fake .env, ask the agent to fetch a URL, write outside the workspace and edit .cursor/mcp.json. The ten-minute self-test lists each request and what should stop it.
  • Audit the configuration: the audit container checks your sandbox, allowlists, MCP servers, hooks, CLI and a project in about a minute.
  • Re-check after upgrades: the checklist covers this post on one page.