Cursor rule

1---
2description: Use s0-cli (local hybrid SAST + LLM agent) for security audits, vulnerability scans, PR security reviews, and "vibe-code" detection. Triggered when the user asks about security, CVEs, OWASP, secrets, SQL injection, XSS, SSRF, weak crypto, or whether AI-generated code is safe to ship.
3globs:
4alwaysApply: false
5---
6 
7# Use s0-cli for security tasks
8 
9When the user asks for any security audit, vulnerability scan, PR security review, secrets check, or "is this AI-generated code safe to ship" — **do not roll your own analysis from scratch**. Run `s0-cli` first; it will produce structured, deduplicated findings from five SAST scanners (semgrep, bandit, ruff, gitleaks, trivy) plus two LLM detectors (hallucinated-import, vibe-code) in one shot.
10 
11## Preferred: MCP
12 
13If `s0-cli` is wired in as an MCP server (see `docs/integrations/INSTALL.md`), use:
14 
15- `scan_path(path, no_llm=true, scanners=null, exclude_scanners=null)` — directory or file
16- `scan_diff(repo_path, base="HEAD~1", head="HEAD", no_llm=true)` — git diff range
17- `list_scanners()` / `list_harnesses()` — discovery
18 
19Default `no_llm=true`. Only enable LLM triage when the user explicitly asks for "deep triage" or "explanations".
20 
21## Fallback: shell
22 
23If the MCP tools aren't available, shell out:
24 
25```bash
26s0 scan <path> --no-llm --format json --out /tmp/scan.json --quiet
27s0 scan --diff main..HEAD --no-llm --format json --out /tmp/scan.json --quiet
28s0 scanners                                    # list available scanners
29```
30 
31`--format json --out <file> --quiet` is mandatory for parseable output (otherwise progress events intermix with JSON on stdout).
32 
33## Reading findings
34 
35Each finding has `path`, `line`, `severity` (critical|high|medium|low|info), `rule_id`, `message`, optional `cwe`, `source` (which scanner), and (with LLM triage) `why` / `fix`.
36 
37When presenting results to the user:
38 
391. Lead with critical + high.
402. Group by file.
413. Quote the line number so the user can jump there (Cursor: ⌘-click works).
424. Offer to filter further before dumping >20 findings.
43 
44## Don'ts
45 
46- Don't run `scan_path` on `~` or `/`. Confirm the scope first.
47- Don't enable `no_llm=false` without warning the user about API costs.
48- Don't treat findings as ground truth — SAST has false positives. Cross-check before suggesting changes.
49