Chainguard for Cursor

Bring Chainguard's secure container images and hardened library dependencies into your Cursor AI workflow. Query images, check security advisories, inspect SBOMs, migrate Dockerfiles, and configure Chainguard Libraries for Java, JavaScript, and Python — all from the agent chat.

What's included

Skills

Invoke with / in the agent chat:

Skill	What it does
/chainguard-find-image	Find the right cgr.dev image for your language, framework, or tool
/chainguard-inspect-image	List packages, SBOM summary, entrypoint, and config for an image
/chainguard-check-advisories	Query CVEs and security advisories for an image or APK package
/chainguard-compare-versions	Show version history, changelogs, and digests across image tags
/chainguard-migrate-dockerfile	Rewrite a Dockerfile to use Chainguard base images
/chainguard-libraries-java	Configure Maven or Gradle to use Chainguard Libraries
/chainguard-libraries-javascript	Configure npm, Yarn, or pnpm to use Chainguard Libraries
/chainguard-libraries-python	Configure pip, uv, or Poetry to use Chainguard Libraries
/chainguard-setup-auth	Verify and set up Chainguard authentication via chainctl

Rules

Applied automatically based on the file you're editing:

Rule	Activates on
Prefer Chainguard Images	Dockerfile, docker-compose.yml
Chainguard Libraries — Java	pom.xml, build.gradle, *.gradle.kts
Chainguard Libraries — JavaScript	package.json, .npmrc, .yarnrc*
Chainguard Libraries — Python	requirements*.txt, pyproject.toml, Pipfile
Supply Chain Policy	GitHub Actions workflows

MCP Servers

The skills above use four Chainguard MCP servers for live data:

Server	Endpoint	Provides
cg-oci	cgr.dev/mcp	Image lookup, tags, digests
cg-apk	apk.cgr.dev/mcp	APK package queries
cg-versions	versions.cgr.dev/mcp	Version history and changelogs
cg-api	console-api.enforce.dev/mcp	Policies, advisories, org context

Requirements

• Cursor
• A Chainguard account — sign up free at chainguard.dev

MCP Server Setup

The MCP servers authenticate via OAuth 2.0. Cursor handles this natively — no manual configuration required.

When you first invoke a skill that uses an MCP server, Cursor will open a browser tab to complete authentication. Sign in with your Chainguard account and return to Cursor. Each server authenticates once and stays connected.

If a server shows as disconnected in Settings → MCP, click the reconnect button to re-authenticate.

Chainguard Libraries

Chainguard Libraries provides hardened, continuously-patched builds of popular open source packages for Java (Maven/Gradle), JavaScript (npm/Yarn/pnpm), and Python (pip/uv/Poetry).

Use the /chainguard-libraries-java, /chainguard-libraries-javascript, or /chainguard-libraries-python skills to configure your project. Each will walk you through obtaining a registry token and updating your package manager configuration.

You'll need a Chainguard Libraries subscription — contact chainguard.dev for access.

Usage examples

Find an image

/chainguard-find-image — find me a Python 3.12 image for production

Resolves your organization, queries the catalog, and returns a digest-pinned reference:

cgr.dev/mycompany/python:latest@sha256:a1b2c3...   # minimal, distroless runtime
cgr.dev/mycompany/python:latest-dev                # includes shell + pip for builds

---

Inspect an image

/chainguard-inspect-image — what packages are in cgr.dev/mycompany/nginx:latest?

Lists all APK packages, the entrypoint, architecture, and whether the image runs as non-root.

---

Check for CVEs

/chainguard-check-advisories — are there any open CVEs in cgr.dev/mycompany/go:latest?

Returns CVE IDs, severity, affected versions, and Chainguard's advisory status (fixed, not_affected, etc.). Reports explicitly if none are found.

---

Compare versions

/chainguard-compare-versions — what changed between the last two releases of cgr.dev/mycompany/node?

Shows a changelog with package version bumps, CVE fixes, and the sha256 digest for each release so you can pin to a known-good version.

---

Migrate a Dockerfile

/chainguard-migrate-dockerfile — harden this Dockerfile:

FROM node:20
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
CMD ["node", "server.js"]

Rewrites the Dockerfile using a multi-stage build: -dev variant for the build stage, minimal distroless runtime for the final stage, pinned to the current digest.

---

Set up Chainguard Libraries — Java

/chainguard-libraries-java — configure our Maven project to pull from Chainguard Libraries

Walks through adding the Chainguard Maven registry to settings.xml and the token configuration for authenticated pulls.

---

Set up Chainguard Libraries — JavaScript

/chainguard-libraries-javascript — we use pnpm. Set up Chainguard Libraries as our npm registry.

Produces the .npmrc configuration with the Chainguard registry URL and auth token setup for pnpm workspaces.

---

Set up Chainguard Libraries — Python

/chainguard-libraries-python — configure uv to use Chainguard Libraries as our PyPI index

Updates pyproject.toml or uv.toml to point to the Chainguard Python registry with token-based authentication.

---

Check authentication

/chainguard-setup-auth — I'm on a new machine, walk me through getting set up

Checks for chainctl, runs chainctl auth login if needed, and confirms access with chainctl iam organizations list.

License

Apache 2.0 — see LICENSE.