Skip to content

CYBO Attest in Cursor

Before you start

Connecting CYBO Attest to Cursor takes about a minute. You need:

  • An Attest account. Create one at attest.ulapcybo.app first; your free trial starts at registration.
  • Cursor, signed in, on a plan that includes the Agent.

The connection details, in case you are asked for them:

Item Value
Server type Remote MCP server, HTTP transport
Server URL https://attest.ulapcybo.app/mcp
Suggested name cybo_attest
Sign in OAuth, with your Attest account
Config file ~/.cursor/mcp.json for all projects, .cursor/mcp.json in a repo for one project

Add the server

  1. Open Cursor Settings, then MCP (on some versions, Tools and MCP).
  2. Click Add new global MCP server. Cursor opens ~/.cursor/mcp.json.
  3. Paste this and save:
{
  "mcpServers": {
    "cybo_attest": {
      "url": "https://attest.ulapcybo.app/mcp"
    }
  }
}

To share Attest with everyone on a repo, put the same block in .cursor/mcp.json at the repo root and commit it. The file only carries the URL; each person signs in with their own Attest account.

Sign in and try it

  1. Back in the MCP settings, cybo_attest appears in the list with a Login (or Needs login) button. Click it.
  2. Your browser opens to the Attest sign in page. Log in with your Attest account, approve the consent screen, and return to Cursor. The server shows a green dot and its tools.
  3. Open the Agent chat and type: Who am I in CYBO Attest? It answers with your name and organization, which confirms the sign in.
  4. Ask: What is the security posture of my applications?

Cursor asks you to run each Attest tool call before it runs. Approve the read tools; for tools that change something (starting a scan, submitting a justification) keep approving per call until you are comfortable. Turning on auto run skips the prompt, so leave it off for the write tools.

Useful next prompts, with the repo open:

  • Explain the first finding and show me where it applies in this codebase
  • Get the Attest fix plan for this app and apply it here, one change at a time
  • Ask Attest for a fixed Dockerfile, compare it with ours, and apply the changes
  • I pushed the fix. Scan the latest code of [app], follow it, and tell me which findings are gone and which remain

Good to know

The rescan is how a fix gets proven. Once the fix is on the default branch, ask the agent to scan the latest code. Attest pulls the newest commits, rebuilds the container, and runs the scans; the agent follows the build and then lists the findings on the new scan, so you see what closed and what is left. Asking to start a scan without new code re runs the scans on the build Attest already has, which is for when a justification or configuration changed, not the code.

The agent reads findings and edits code in the same turn. That is the point of using it from the editor: "fix the Attest findings that apply to this file" reads the findings through Attest and then edits the file in front of you.

Writes carry your name. Every change the agent makes is logged in Attest as you, with the client that made it. The agent cannot approve or reject a build; that stays in the Attest console with a named person.

Turn tools off per session. In the MCP settings you can disable individual Attest tools. Turning off the write tools is a good default for sessions that only need answers.

If something goes wrong

Symptom Fix
cybo_attest does not appear in MCP settings Check ~/.cursor/mcp.json is valid JSON with the block above, then restart Cursor
Red dot, no Login button The URL is wrong or blocked. Compare it to https://attest.ulapcybo.app/mcp exactly, including /mcp
Login opens the browser but Cursor never updates Keep the tab open until Cursor shows the green dot; if it does not, click the refresh icon next to the server and Login again
Sign in page says invalid scopes or unknown client Remove the entry, save, add it again, and Login; that registers a fresh client. If it repeats, send the exact text to Ulap support
Tools return 401 or 403 Your session expired or your Attest role lacks access to that application. Login again and check your role in Attest
The agent uses another tool instead of Attest Say "use Attest" in the prompt, or name the tool with @ in the chat

Still stuck? Contact Ulap support with the exact error text and a screenshot.