Cursor HistorySAFE
MCP server for browsing, searching, and exporting Cursor AI chat history.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/cursor-history-mcp) [](https://www.npmjs.com/package/cursor-history-mcp) [](LICENSE) [](https://nodejs.org/)
English | 中文 | Français | Español
Let your AI search your Cursor history.
Your existing Cursor conversations may already contain months of decisions, bugs, fixes, and architectural context. Give an MCP-capable assistant a way to find that context—without having recorded it with this tool beforehand.
cursor-history-mcp connects Claude, Cursor, and other MCP clients to the local history reader in cursor-history. Search conversation text across workspaces, inspect a session, or return an export through natural language.
No embeddings, indexing service, or API key is required by this server. Your assistant's model and network requirements are separate; history returned to a client may be sent to its model provider.
MCP-exclusive: Year in Review. Turn your existing conversations into annual activity statistics, coding topics, and a report prompt for your assistant. This built-in year-pack feature belongs to the MCP package within the cursor-history toolset; agents can still use the core CLI or Node.js API directly for history access.
“Have we solved this authentication bug before? Search my Cursor history, inspect the matching sessions, and tell me which earlier decisions are
f5d755a227f1OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add cursor-history-mcp -- npx -y [email protected]
Exposed tools (8)
7 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cursor_history_backup | read | Back up Composer chat history to a restorable ZIP archive. Store databases, Agent transcripts and ACP stores are not included. |
cursor_history_export | read | Export a Cursor AI chat session to Markdown or JSON format. Returns the formatted content. |
cursor_history_list | read | List Cursor AI chat sessions. Returns recent sessions with metadata including workspace, message count, and timestamps. |
cursor_history_migrate | write | Move or copy eligible Composer sessions between workspaces. Store-only, merged-source and ambiguous sessions are refused. Use dryRun to preview. Moving removes the original; back up first. |
cursor_history_restore | read | ⚠️ DESTRUCTIVE: Restore Composer databases from a backup archive. This can overwrite Composer history; it does not restore Store databases, Agent transcripts or ACP stores. Back up current Composer data first. |
cursor_history_search | read | Search across all Cursor AI chat sessions for a keyword or phrase. Returns matching sessions with context around each match. |
cursor_history_show | read | Inspect the available messages and tool activity in a Cursor session, with source and timestamp provenance. Long thinking and tool payloads are abbreviated; use export for unabridged available content. |
cursor_history_year_pack | read | Generate a year-in-review data package from Cursor AI chat history. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
const hash = createHash("md5").update(project).digest("hex");(cd "$script_dir/../../.." && pwd)
import { mapCursorHistoryError, isMcpError } from "../../errors.js";import { handleListSessions } from "../../src/tools/list-sessions.js";import { handleShowSession } from "../../src/tools/show-session.js";import { handleSearch } from "../../src/tools/search.js";@eslint/js, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, typescript-eslint
docs/readme-banner.png
Gates applied: no_behavioural_pass.
f5d755a227f1full audit observations/trust-audit/mcp-server/s2thend__cursor-history-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f5d755a227f1 | SAFE | B | 89 | first audit |
Questions
What is the Cursor History MCP server?
MCP server for browsing, searching, and exporting Cursor AI chat history.
What tools does Cursor History expose?
8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Cursor History safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Cursor History need?
No credential environment variables were found in its source, so it appears to need none.
How does Cursor History run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as cursor-history-mcp at 0.3.1.
How current is this page?
The grade is for one exact copy of the source (f5d755a227f1), read on 2026-10-08. The repository is watched and re-audited when it changes.