MCP Config Tamper - Cursor Trusted Server Rewrite
Cursor's AI editor lets a user approve an MCP (Model Context Protocol) server once, after which edits to that server's config run without asking again. This rule flags process activity that edits or overwrites the Cursor MCP config file, or writes a new MCP server definition with a command to run — the step an attacker uses to slip in malicious code that Cursor will execute without any further prompt.
How the attack works
An attacker gets write access to a shared repo branch or the local filesystem where a Cursor project lives. They locate the MCP config file (mcp.json, mcp_settings.json, or similar under .cursor) that the user has already approved. They overwrite or edit it — via shell redirection, sed -i, cp/mv, PowerShell file-write cmdlets, or a script call like writeFileSync or Python's open(...,'w') — replacing a trusted entry with one that runs an arbitrary command. The next time the user interacts with Cursor, that command runs with the user's own privileges, with no re-approval dialog.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c9d2a-5b41-4e8c-9a17-6d2f8b40c153
- Severity
- High
Why it matters
An attacker gets code execution on the developer's machine as that user, without any visible warning, by abusing a config file the victim already trusted. This can lead to further compromise of the developer's environment, credentials, or the codebase itself.
What you can do
- →Restrict write access to .cursor/mcp.json and related MCP config files to trusted maintainers only, and treat them like any other sensitive config in code review.
- →Add these files to required-review paths in your repo (e.g. CODEOWNERS) so changes can't merge silently.
- →Watch for onboarding scripts, template generators, or dotfile managers that legitimately provision mcp.json, so you can tell those apart from unexpected edits.
- →Periodically diff the live MCP config on developer machines against the version-controlled one to catch unauthorized local tampering.
Known benign look-alikes
- Onboarding or dotfile bootstrap scripts that legitimately provision .cursor/mcp.json for a new machine.
- Repository tooling that regenerates the MCP config from a template (jq/sed pipelines writing mcp.json).
- Configuration managers (chezmoi, ansible shell tasks, Makefile targets) copying an mcp.json into place.
- Backup and restore of an existing mcp.json (cp/mv within .cursor) before an intentional change.
- MCP installer CLIs invoked by the user that write the config with an embedded mcpServers JSON blob.
- CI jobs and test suites that materialise an mcp.json fixture before running integration tests.