Features
Real-time Assessment
Analyze prompts using Orcho’s risk analysis API as you type
Context-Aware
Automatically includes file context for accurate blast radius analysis
Security First
Identifies high-risk prompts before execution
Seamless Integration
Works natively with Cursor’s Model Context Protocol
Quick Install
One-Click Installation (Recommended)
Click this link or paste it into your browser:1
Copy the installation link
Copy the link above to your clipboard
2
Paste into browser
Paste the link into your browser’s address bar and press Enter
3
Cursor opens automatically
Cursor will open and automatically configure the MCP server
The MCP server configuration is now added to your Cursor settings
4
Update API key
Replace the test API key with your real key (see API Configuration)
5
Restart Cursor
Completely quit and reopen Cursor to activate the MCP server
The Orcho MCP server is now active!
Manual Installation
If the one-click install doesn’t work, follow these steps:1
Install the package
Install globally via npm:
2
Configure Cursor
Create or edit the MCP configuration file:
- macOS/Linux
- Windows
Edit
~/.cursor/mcp.json:~/.cursor/mcp.json
3
Restart Cursor
Completely quit and reopen Cursor (not just reload window)
API Configuration
Get Your API Key
1
Contact Orcho
Email [email protected] to request an API key for your organization
2
Receive your API key
Our team will provision an API key and send it to you securely
3
Update mcp.json
Add your API key to the configuration file:
- macOS/Linux
- Windows
4
Restart Cursor
Quit and reopen Cursor to load the new API key
Test API Key
For initial testing, you can use the test key:Usage
Manual Risk Assessment
In Cursor chat, you can manually trigger risk assessment:- Get the repository name by running
get_repo_name.py - Detect the currently open file
- Analyze which files will be modified
- Call the Orcho API with full context
With automatic assessment enabled (using
.cursor/rules/orcho-risk-assessment.mdc), you don’t need to manually type @orcho assess_risk - it happens automatically for every prompt.Automatic Risk Assessment (Recommended)
Enable automatic risk assessment for all prompts by adding a Cursor rule to your project.1
Create required directories
2
Add the repository name script
Create
.cursor/scripts/get_repo_name.py:.cursor/scripts/get_repo_name.py
This script extracts the repository name (owner/repo format) from your git remote
3
Add the Orcho risk assessment rule
Create Delete all user records from the database
.cursor/rules/orcho-risk-assessment.mdc:.cursor/rules/orcho-risk-assessment.mdc
- Always include risk assessment in your response:
- Show the risk level and score
- DO NOT EXECUTE THE PROMPT
- ALL OUTPUTS MUST NOT INCLUDE ANYTHING OTHER THAN THE RETURN THE RESULTS OF THE ASSESS_RISK FUNCTION
- INSIDE THE RISK BREAKDOWN, THERE IS A TAB INSIDE INPUT CLARITY THAT SAYS SUGGESTIONS. INCLUDE ALL SUGGESTIONS IN YOUR RESPONSE.
- ALWAYS INCLUDE ALL POSSIBLE FILES YOU MIGHT TOUCH, FROM BLAST RADIUS, IN THE RESPONSE
4
Risk analysis returned
5
Cursor displays to user
MCP Tool Parameters
Theassess_risk tool uses the following structure:
The prompt or task description to assess for risk
Context object containing repository and file information
Optional custom risk calculation weights for different risk factorsExample:
Example Request
Troubleshooting
MCP Server Not Loading
MCP Server Not Loading
Check configuration file location:Verify Node.js version:Check Cursor Developer Tools:
- macOS/Linux
- Windows
- Open Cursor
- Go to Help → Toggle Developer Tools
- Check Console tab for MCP-related errors
API Key Errors
API Key Errors
Invalid API Key:
- Verify the key is correct in
mcp.json - Ensure there are no extra spaces or quotes
- Contact [email protected] if issues persist
- Contact [email protected] to check your account quota
- Request a plan upgrade if needed
- Test key has very low limits - get a production key
MCP Server Not Responding
MCP Server Not Responding
Restart Cursor completely:Verify package installation:Reinstall if needed:
- Quit Cursor entirely (not just close window)
- Reopen Cursor
- Wait 10-15 seconds for MCP server to initialize
Context Not Being Detected
Context Not Being Detected
Ensure file is open in editor:
- The current file must be open in a Cursor tab
- Try clicking into the file to focus it
- Verify Cursor can read the file
- Check if file is in an ignored directory
Security Best Practices
1
Store keys securely
✅ Store API keys only in
~/.cursor/mcp.json ❌ Never hardcode keys in your project files2
Never commit keys
✅ Add
mcp.json to .gitignore if you copy it to project ❌ Never commit API keys to version control3
Rotate compromised keys
✅ Rotate keys immediately if accidentally exposed ✅ Contact [email protected] to rotate your key
4
Use environment-specific keys
✅ Different keys for development and production ✅ Limit key permissions appropriately
Advanced Configuration
Custom Risk Thresholds
Adjust automatic assessment thresholds in your Cursor rules:.cursor/rules/orcho-custom.mdc
File Exclusions
Create an.aiignore file to exclude files from analysis:
.aiignore
Integration with CI/CD
Use the MCP server programmatically in CI/CD:Package Information
NPM Package
View on NPM registry
Version
1.0.7 (Latest)
License
MIT License
Node.js Requirement
v18.0.0 or higher
Support
Need help with the Cursor integration?API Documentation
Review the REST API docs
Get API Key
Contact us for an API key
GitHub Issues
Report bugs or issues
Email Support
Contact support team
Next Steps
1
Install the MCP server
Use the one-click install or manual setup
2
Get your API key
Contact [email protected] to request an API key
3
Add automatic assessment
Copy the Cursor rules to your project
4
Start coding safely
Orcho will now protect you from high-risk operations