Security scanning for Cursor projects
Cursor is fast at producing working code and quiet about whether that code is safe. SixthWall scans the project from the terminal or on every commit, and each finding comes with a prompt you paste back into Cursor's chat to fix it.
Three steps
- 01
Run init in your project
This installs a pre-commit hook so nothing with a critical finding gets committed, writes a config file, and runs your first scan.
npx @sixthwall/cli init - 02
Scan as you go
Run a scan after Cursor finishes a task, or leave watch mode running in a terminal tab to rescan on every save.
npx @sixthwall/cli watch - 03
Paste the fix back into Cursor
Each finding prints a ready-made prompt. Paste it into Cursor's chat with the file open and let it make the change.
What it looks for
The same rules run for every project, whatever tool wrote the code. These are the most serious ones. See all rules.
Questions
Does it work as a Cursor MCP server?
The MCP server works in any client that supports MCP. Automatic Cursor MCP configuration during init is on the roadmap; for now the CLI and pre-commit hook are the fastest path.
Does my code leave my machine?
No. The scanner runs locally, makes no network calls during a scan and needs no account. The only download is the scanner itself.
Is it free?
Yes. The editor scanner, the Claude Code integration, the pre-commit hook and the GitHub Action are free with no limits.