About VulX Watch
VulX Watch is a security-review connector for AI-built applications, intended for developers using Cursor. It watches a GitHub repository and reports the latest findings; it does not patch code or open pull requests.
Key features
- 01Watch a GitHub repository
- 02Ask for the latest security findings
- 03Cursor skill and commands
- 04No patches or pull requests
Use cases
- 01Request a security review of a repository
- 02Check findings from the latest review
MCP support
Provides an MCP server at `https://mcp.vulx.ai/mcp`. Cursor connects to it to watch repositories and retrieve security findings.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://mcp.vulx.ai/mcpclaude mcp add --transport http ai-vulx-watch https://mcp.vulx.ai/mcp{"mcpServers":{"ai-vulx-watch":{"type":"http","url":"https://mcp.vulx.ai/mcp"}}}Open in Cursor{"servers":{"ai-vulx-watch":{"type":"http","url":"https://mcp.vulx.ai/mcp"}}}Open in VS Code{"mcpServers":{"ai-vulx-watch":{"type":"http","url":"https://mcp.vulx.ai/mcp"}}}{"mcpServers":{"ai-vulx-watch":{"serverUrl":"https://mcp.vulx.ai/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
Details
From the project READMEVulX Watch for Cursor
Adds the VulX Watch connector to Cursor: independent security review for AI-built apps. The agent can watch a GitHub repo and ask what the last reading found.
VulX does not write a patch or open a PR.
What you get
- MCP server at
https://mcp.vulx.ai/mcp - A skill so the agent knows when to call Watch
- Commands: watch-repo, security-status
You still need a VulX account. Sign-in happens when Cursor talks to the connector. Free while we build it.
Install
- Install VulX Watch from the Cursor Marketplace, or clone this repo
into
~/.cursor/plugins/localand restart Cursor. - Complete the VulX sign-in prompt.
- Ask:
Watch my repo owner/name with VulX.Then:What did VulX find?
If OAuth does not finish inside Cursor, add the same URL as a custom
connector: https://mcp.vulx.ai/mcp. Human page: https://vulx.ai/connect
What it will not do
- Patch your app or open a merge-ready PR
- Log in to your running site or database
- Give a 0–100 score or a “safe to ship”
- Treat a quiet week as an all-clear
It reads committed source. It writes only its own brief (AGENTS.md and
CLAUDE.md) when brief delivery is on.
License
MIT
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.