Skip to main content
Cursor gets three pieces: the MCP server (scan tools, global), an observational stop hook (global, beta), and a project rule (per project) that directs the agent to scan the code it writes.

​
What the installer writes

​
The project rule (run once per project)

Cursor loads agent rules from <project>/.cursor/rules/, and global “User Rules” are only editable through the GUI — so the rule must be installed per project:
This writes .cursor/rules/zeropath.mdc (alwaysApply: true), which tells Cursor’s agent to submit its diff to asyncCodeScans.submit with task context in additionalContext, and to fix critical/high findings before declaring a task done. Commit the file if you want the whole team to get the behavior.

​
Manual MCP setup

In ~/.cursor/mcp.json (or per-project .cursor/mcp.json):

​
Hook caveats

Cursor’s hooks (~/.cursor/hooks.json) are a beta feature and their stop event cannot block the agent — so on Cursor the stop hook is monitoring-only: it scans the uncommitted diff and writes the report to ~/.zeropath/logs/. Deterministic enforcement on Cursor therefore comes from the project rule + MCP path, and from ZeroPath PR scanning downstream. If your Cursor version predates hooks support, the entry in hooks.json is simply ignored.

​
Verify

  • Settings → MCP: zeropath listed with its tools after a restart.
  • Ask the agent to “scan my uncommitted changes with ZeroPath” and confirm it calls the asyncCodeScans.* tools.
  • After an agent session that changed code, check ~/.zeropath/logs/ for a scan-cursor-stop-*.json report.