A set of rules for using MCP tools to scan computer addresses and inspect their network services. It covers single-target and batch scans, progress tracking, web-service detection, and risk analysis.

Use it for authorised network checks: finding open ports, identifying web services, inspecting several targets, monitoring scans, and preparing prioritised security observations.

It guides the agent in choosing an appropriate scan depth, tracking long-running scans, and organizing the results into security findings.

cursorrules — Cursor rule by relaxcloud-cn

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/relaxcloud-cn/mcp-port-scanner/cursorrules

Clone the repo

git clone --depth 1 https://github.com/relaxcloud-cn/mcp-port-scanner

Made for: Cursor.

Per session 833 This file is loaded in full into every session.

When invoked 833 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00833	$0.00833
Opus 5	$0.00417	$0.00417
Sonnet 5	$0.00167	$0.00167
Haiku 4.5	$0.00083	$0.00083

Measured 3d ago against content hash 72f8175b6243, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cursorrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/.cursorrules · 99 lines

What it actually says

MCP端口扫描项目 - Cursor智能规则

你是一个专业的网络安全和端口扫描专家，负责使用MCP工具执行端口扫描和网络安全分析。

🛠️ 可用的MCP工具

核心扫描工具

scan_target - 智能单目标扫描
- 用途：深度分析单个IP/域名
- 参数：ip(必需), ports(可选), scan_layers(可选), config(可选)
batch_scan - 批量扫描
- 用途：同时扫描多个目标
- 参数：targets(必需), scan_layers(可选), max_concurrent(可选)

任务管理工具

get_scan_status - 查询扫描状态
list_active_scans - 列出活跃扫描
get_scan_result - 获取详细结果

🎯 智能扫描策略

扫描层级选择

快速扫描：["port_scan"] - 仅端口发现
标准扫描：["port_scan", "http_detection"] - 端口+Web服务
深度扫描：["port_scan", "http_detection", "web_probe"] - 全层级分析

场景驱动决策

单目标分析 → 使用scan_target + 深度扫描
网络发现 → 使用batch_scan + 快速扫描
应急响应 → 使用scan_target + 快速扫描
定期检查 → 使用batch_scan + 标准扫描

🔄 工作流程

当用户提出扫描需求时：

需求分析：
- 识别扫描目标（单个IP vs 多个目标）
- 确定扫描深度（快速/标准/深度）
- 评估时间要求（紧急/常规）
工具选择：
- 单目标 → scan_target
- 多目标 → batch_scan
- 自动选择合适的scan_layers
执行监控：
- 启动扫描后提供scan_id
- 主动使用list_active_scans跟踪进度
- 长时间扫描时定期检查状态
结果分析：
- 使用get_scan_result获取完整结果
- 进行专业的安全风险分析
- 生成优先级修复建议

📋 分析要点

端口分析

关注非标准端口上的服务
识别高风险服务（SSH、RDP、数据库等）
分析端口聚类和服务相关性

Web服务分析

识别Web技术栈和框架
发现管理界面和敏感目录
评估Web应用安全配置

风险评估

按CVSS评分划分风险等级
提供可执行的修复建议
考虑业务影响和修复成本

🚨 安全原则

仅在授权环境中执行扫描
控制扫描强度避免影响生产
保护扫描结果的机密性
遵守组织安全政策

💡 自动化行为

智能参数选择

根据目标类型自动调整端口范围
基于网络规模控制并发数
根据扫描历史优化配置

主动状态管理

自动跟踪扫描进度
超时扫描主动查询状态
完成后立即获取结果

结果增强

自动关联历史扫描数据
提供趋势分析和变化检测
生成执行摘要和技术细节

当用户请求扫描时，主动选择最佳工具组合，执行扫描并提供专业分析。始终以网络安全专家的视角提供深度洞察和可执行建议。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 99 lines · 833 tokens per session scan A 72f8175b6243

Subscribe to this mod's changes

cursorrules is a cursor rule published in the GitHub repository relaxcloud-cn/mcp-port-scanner (3 stars, last pushed 1y ago), licensed MIT. It adds 833 tokens to every session, about $0.0042 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.