Hardening Cursor (.cursor/mcp.json) & Claude Desktop Configurations

Step-by-step workstation hardening playbook for Cursor IDE and Claude Desktop mcp.json files: secret injection, directory scoping, and safe --fix backups.

1. Standard MCP Configuration File Paths

• Cursor IDE (Workspace): .cursor/mcp.json
• Cursor IDE (Global): ~/.cursor/mcp.json
• Claude Desktop (macOS): ~/Library/Application Support/Claude/claude_desktop_config.json
• Claude Desktop (Windows): %APPDATA%\Claude\claude_desktop_config.json

2. Eliminating Plaintext Tokens in .cursor/mcp.json

Developers frequently paste live GitHub Personal Access Tokens (ghp_...), OpenAI keys (sk-proj-...), or production PostgreSQL connection strings directly into .cursor/mcp.json. MCPShield detects 10+ credential formats and replaces them with environment references while masking the secret in terminal logs (ghp_998***REDACTED***).

3. Scoping Filesystem & Database Servers

Never pass /Users/username or / to @modelcontextprotocol/server-filesystem. Scope the server to the active repository root (./workspace) and connect database MCP servers to read-only replicas.

4. Running Safe Auto-Remediation (--fix)

# Writes hardened config to .cursor/mcp.hardened.json without touching original
node ./bin/mcpshield.mjs fix ./.cursor/mcp.json

# In-place update automatically creates ./.cursor/mcp.json.bak first
node ./bin/mcpshield.mjs fix ./.cursor/mcp.json --in-place