使用说明

Cursor Enforcement MCP Server

Token Messenger pattern implementation for enforcing protocols in Cursor IDE.

The Problem

Cursor has no enforcement mechanism. Rules in .cursorrules or .cursor/rules/*.mdc are advisory only (~50% compliance). The AI can ignore them.

Claude Code has PreToolUse hooks with exit code 2 that block operations. Cursor has nothing equivalent.

The Solution: Token Messenger Pattern

This MCP server creates enforcement through cryptographic token chains:

preflight_check → Validates bootstrap state, issues signed token
gated_write/gated_edit → Require valid preflight token to execute
research_gate → Validates research type, recommends skill usage

Without a valid token chain, gated operations fail. The AI can't bypass this because the validation happens server-side.

How It Works

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│   AI Request    │────▶│  preflight_check │────▶│  Token Issued   │
│  "write file"   │     │  (validates)     │     │  (if valid)     │
└─────────────────┘     └──────────────────┘     └────────┬────────┘
                                                          │
                                                          ▼
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  Write Success  │◀────│   gated_write    │◀────│  Token Passed   │
│                 │     │  (validates)     │     │                 │
└─────────────────┘     └──────────────────┘     └─────────────────┘

Installation

cd ~/claude-global-config/cursor/mcp-enforcement
pip install -e .

Cursor Configuration

Add to your Cursor settings (.cursor/mcp.json or global settings):

{
  "mcpServers": {
    "enforcement": {
      "command": "python",
      "args": ["-m", "server"],
      "cwd": "/Users/YOUR_USER/claude-global-config/cursor/mcp-enforcement"
    }
  }
}

Or use the uv runner:

{
  "mcpServers": {
    "enforcement": {
      "command": "uv",
      "args": ["run", "python", "server.py"],
      "cwd": "/Users/YOUR_USER/claude-global-config/cursor/mcp-enforcement"
    }
  }
}

Tools

preflight_check

Required before any file modifications.

Input:
  working_directory: "/path/to/project"

Output:
  - Token if bootstrap requirements met
  - Error if .agents/ or .beads/ missing (for project directories)

gated_write

Write file with token validation.

Input:
  preflight_token: "..." (from preflight_check)
  file_path: "/path/to/file"
  content: "file content"

Output:
  - Success if token valid
  - BLOCKED if token invalid/expired/missing

gated_edit

Edit file with token validation.

Input:
  preflight_token: "..."
  file_path: "/path/to/file"
  old_string: "text to replace"
  new_string: "replacement"

Output:
  - Success if token valid and old_string found
  - BLOCKED if token invalid

research_gate

Validate research approach before starting.

Input:
  query: "what you're researching"
  research_type: "comparison" | "comprehensive" | "quick_lookup" | "exploration"

Output:
  - Skill recommendation for comparison/comprehensive/exploration
  - Quick lookup approval for simple queries
  - Research token for tracking

validate_token

Check token validity without consuming it.

Input:
  token: "..."
  expected_type: "preflight" | "research" | "skill"

Output:
  - Valid: remaining time, context
  - Invalid: reason

Cursor Rules Integration

Add to 001-core-protocol.mdc:

## MCP Enforcement

When the enforcement MCP server is available:

1. **Before any file modification**: Call `preflight_check` first
2. **For writes**: Use `gated_write` instead of native Write
3. **For edits**: Use `gated_edit` instead of native Edit
4. **Before research**: Call `research_gate` to validate approach

This ensures bootstrap requirements are enforced, not just suggested.

Token Details

TTL: 5 minutes (configurable)
Signing: HMAC-SHA256 with machine-specific key
Types: preflight, research, skill
Validation: Server-side, cannot be forged

Limitations

AI must choose to use MCP tools - Rules can strongly suggest this but can't force it
40-tool MCP limit in Cursor - Plan tool usage carefully
No Resources support - Cursor only supports MCP tools, not resources

Comparison to Claude Code

Aspect	Claude Code	Cursor + This MCP
Block mechanism	PreToolUse exit 2	Token validation
Enforcement point	Before tool call	Inside MCP tool
Bypass risk	None (hooks are mandatory)	AI could use native tools
Mitigation	N/A	Strong rule language + training

Making It Stronger

To maximize compliance:

Rule language: Use "MUST" and "REQUIRED" in rules
Tool descriptions: Make gated tools more attractive
Error messages: Make native tool usage feel incomplete
Training: Consistent use builds habit

This is the strongest enforcement possible without native hook support.