Docs

Cursor, VS Code & Windsurf

SafeWeave runs as a local MCP server, so any editor that speaks MCP can use it. Add the server once, then your AI agent can scan and fix with SafeWeave's 8 scanners while it codes.

1. Add the MCP server

Cursor: create .cursor/mcp.json in your project (or the global ~/.cursor/mcp.json). VS Code and Windsurf use the same shape in their MCP settings.

{
  "mcpServers": {
    "safeweave": {
      "command": "npx",
      "args": ["-y", "safeweave-mcp"]
    }
  }
}

No license key is needed for the free tier (SAST, secrets, dependencies). Add SAFEWEAVE_LICENSE_KEY to the server's env to unlock Pro scanners.

2. Add the SafeWeave rule (Cursor)

Drop safeweave.mdc into .cursor/rules/. It tells the agent to run a SafeWeave scan before finishing any task that touched auth, the database, payments, or environment/secret files.

3. Use it

Ask your agent to "scan this project with SafeWeave" or let the rule trigger automatically. Findings come back with severity, file:line, and CWE; ask the agent to fix a finding and it will pull the remediation context and re-scan to verify.