Superagent for Cursor

Connect Cursor to Superagent's hosted MCP server and give the Agent guidance for using security findings, reports, Contributor Trust, Context Guardrails, Runtime Guardrails, and signed webhooks safely.

This is a thin client plugin. It does not bundle or execute the Superagent server; Cursor connects to https://www.superagent.sh/mcp over Streamable HTTP.

Included

• The superagent remote MCP connection
• The superagent Agent Skill
• Secure API-key configuration through Cursor plugin variables

Install

Until the plugin is listed in the Cursor Marketplace, clone this repository into Cursor's local plugin directory:

git clone https://github.com/superagent-ai/cursor-plugin.git \
  ~/.cursor/plugins/local/superagent

Restart Cursor or run Developer: Reload Window, then open Customize and confirm that the Superagent skill and MCP server are present.

Local plugin imports can be disabled by a Teams or Enterprise administrator. When a Marketplace version is installed, it takes precedence over a local copy with the same name.

Configure

1. Create a dedicated organization API key in Superagent Settings.
2. In Cursor, open Plugins → Superagent → Configure.
3. Enter the key as SUPERAGENT_API_KEY.
4. Reload Cursor and confirm that the Superagent MCP server lists its tools.

Never paste the key into chat or commit it to a repository. Prefer a dedicated, revocable key for Cursor. A Superagent organization API key can access the entire organization.

Capabilities

• List and inspect findings and update manual triage
• List and inspect repository, Web app, Agent, and package reports
• Check Contributor Trust
• Scan pages, email, files, skills, packages, and public MCP repositories
• Manage Runtime Guardrails clients, groups, rules, modes, and alerts
• Guide Context Guardrails hook integration and signed webhook setup

The server's available tools are the source of truth and may evolve without a plugin update.

Safety

Some Superagent operations consume organization credits, permanently delete data, or immediately change endpoint policy. The bundled skill requires explicit confirmation before billable, destructive, policy-changing, or organization-wide actions.

Connecting the MCP server does not by itself enforce Context Guardrails before Cursor consumes external context. Enforcement requires a separately approved hook at the relevant tool boundary; the skill explains that setup and its failure modes.

Troubleshooting

• 401 invalid_token: confirm the configured key is active and complete.
• Failed connection or 404: use the exact endpoint https://www.superagent.sh/mcp; the bare domain redirects.
• Connected with no tools: verify that a proxy is not stripping the Authorization header.
• 429: wait for the server's Retry-After interval instead of polling.
• Duplicate tools: remove or disable any personal or workspace superagent MCP entry; the plugin already provides one.

See the Superagent MCP documentation for the current tool catalog and product-specific guidance.

Repository structure

.
├── .cursor-plugin/plugin.json
├── assets/logo.webp
├── mcp.json
└── skills/superagent/SKILL.md

Development

Validate the JSON files:

python3 -m json.tool .cursor-plugin/plugin.json >/dev/null
python3 -m json.tool mcp.json >/dev/null

For local discovery testing, symlink the repository and reload Cursor:

ln -s "$(pwd)" ~/.cursor/plugins/local/superagent

Remove the symlink after testing if you do not want the development copy to remain installed.

Provenance

The hosted MCP endpoint and authentication contract come from superagent-ai/landing.

The bundled skill is based on superagent-ai/skills at verified commit 0da315b873ed141025fa601ed6e0ebe0c878d5af without modification.

License

MIT