MLD-1347 - Cursor rewrite mcp.json

[arielamitjfrog]

Summary

• On Cursor sessionStart, discover plugin mcp.json / .mcp.json under $CURSOR_CONFIG_DIR/plugins/local (plus this plugin’s own config) and run Agent Guard --rewrite-mcp-json so stdio MCP entries launch through @jfrog/agent-guard. Remote URL/HTTP/SSE/WS entries are left unchanged; workspace/user .cursor/mcp.json is out of scope.
• Cursor-specific path discovery lives in scripts/ (cursor-mcp-json-discover.mjs + thin cursor-align-mcp-json.mjs adapter). Shared orchestration (project/server resolution, Step 0 gate, spawn/timeout, soft-fail) is vendored into modules/core/ from jfrog-agent-hooks MLD-1386 (a146a13), with rewrite budget set to 35s so it fits under the 45s hook timeout with gate overhead.
• Soft-fails always (exit 0): kill switch JF_AGENT_REWRITE_MCP_JSON_DISABLE=1, missing project, gate failure, or rewrite errors. Bumps plugin/marketplace version to 0.5.14. Documents env vars and vendor layout in README / VENDOR.md; adds dest_prefix to modules sync config.

Related PRs:

• agent-guard - MLD-1375 - Harness-agnostic rewrite plugins mcp.json
• jfrog-agent-hooks - MLD-1386 - Apply cross harnesses logic

Test plan

• node --test plugins/jfrog/scripts/*.test.mjs
• With Agent Guard enabled + JF_PROJECT (or project in existing _JF_ARGS), start a Cursor agent session and confirm the align hook runs without failing session start
• Stdio MCP under ~/.cursor/plugins/local/*/mcp.json is rewritten through @jfrog/agent-guard; remote entries unchanged
• This plugin’s own mcp.json is included; workspace/user .cursor/mcp.json is not
• JF_AGENT_REWRITE_MCP_JSON_DISABLE=1 skips rewrite
• Missing project / gate disabled → soft no-op (session continues)
• After a successful rewrite, Developer: Reload Window picks up MCP config changes

[arielamitjfrog]

@shay-coh to align the Claude plugin behavior, I added a message when the process completes: JFrog Agent Guard secured your plugins' MCP servers. Open a new session to reconnect.