Cursor SDK

Build a real security automation, live.

Pick which security tool sends the alert, which kind of alert it is, and what you want the agent to do in response. The TypeScript on the right updates as you click — that's actual code being built in real time. Hit Run automation to watch the agent execute the workflow.

Starter workflows(one click loads a curated workflow you can edit)

Step 1

Pick a security tool

8 tools

Step 2

Pick an event

Pick a tool above to see the events it can fire.

handlers/security-webhook.ts

This is real, runnable code. Drop this into an API server. When the chosen tool fires a webhook, this handler launches a Cursor agent with the right MCPs and prompt to automatically resolve an incident.

1import { Agent } from '@cursor/february/agent';
2 
3// Pick a tool, an event, and at least one action.
4// The SDK code that powers this automation will appear here as you build.
5//
6// Cursor's SDK lets you run the same Background Agent that powers this hub
7// from anywhere in your stack: webhooks, scheduled jobs, SOAR playbook
8// steps, even Slack slash commands. The agent gets your MCPs, your
9// repos, and your prompt, and ships work back as structured events you
10// can index in your SIEM.
11

Tool—

Event—

Actions0

MCPs0

Pick a tool, an event, and at least one action to enable Run.