Cursor

Tested on production on 2026-10-03.

1. Add HeaderHawk to ~/.cursor/mcp.json, or to .cursor/mcp.json in a project to share it with the project’s team:

   {
     "mcpServers": {
       "headerhawk": {
         "url": "https://mcp.us.headerhawk.com/mcp"
       }
     }
   }

2. Open Cursor Settings › MCP. HeaderHawk is listed as needing sign-in; choose Login.

3. HeaderHawk’s sign-in page opens: sign in, then choose Authorize on the screen that asks to connect HeaderHawk with Cursor.

4. In the chat, ask, for example, “What CSP does our site enforce?”

Why Cursor shows a warning

The consent screen for Cursor says “Warning: Unverified Application”. Cursor registers itself each time it connects, by Dynamic Client Registration, and names itself as it does, so HeaderHawk cannot confirm that it is Cursor. That is expected. Authorize it only when you have just added HeaderHawk to Cursor yourself.

Disconnecting

Remove headerhawk from mcp.json, and disconnect it under Settings › API keys › Connected assistants in HeaderHawk. See Connect an AI assistant.