Port Claude plugin 1.16.1 fixes and GraphQL support into the Cursor plugin, bumping it to 1.17.0

What they did

The author brought the 42Crunch Cursor plugin from v1.16.0 up to v1.17.0 so it matched the Claude, Copilot, Codex and Kiro plugins, which had already shipped 1.16.1 (bug fixes) and 1.17.0 (GraphQL support) on 2026-11-03. They translated Claude's v1.16.0 → v1.17.0 changes into Cursor-specific wording and applied them hunk by hunk against Cursor's current text, then ran a check confirming Cursor still differs from Claude only where it did before, apart from the intended updates. The 1.16.1 fixes addressed: a scan happy-path check that read fields the report never contains (so it always said "none"); scan re-runs failing with status 12 because 42c-ast won't overwrite an existing --output report; an audit extraction reading a literal $OUTPUT_DIR inside a quoted heredoc; and pre-flight pointing at the removed code-to-oas skill. The 1.17.0 work added a GraphQL schema audit and a live GraphQL scan including BOLA/BFLA, plus a confirmation step that checks each authorization finding against response data because GraphQL servers often return HTTP 200 with an error. Token mode was scoped to the default SQG policy only, so audit workflows use the session target score instead. Cursor wording was preserved: AskQuestion for multiple-choice prompts, with tokens, API keys, URLs and test values asked conversationally in chat, and the GraphQL credential and test-data steps saying so explicitly. README and RECIPES were refreshed for Starter/Token/Platform naming, paid plans and GraphQL sections, while Cursor's install steps and Recipe 2 stayed unchanged. They also fixed issues already on main: token-limit.md used AskUserQuestion six times and now uses AskQuestion for choices plus conversational asks for the token, API key and URL; Free Trial links in credential-setup.md and the setup skill used source=claude. The version was set to 1.17.0 and the license field switched to the SPDX id Apache-2.0.

How it went

node scripts/validate-template.mjs passes, with only expected warnings about missing hooks and MCP files. The GraphQL test suite used for the other plugins, run against these docs on 42c-ast 3.60.3, scored 24/24 in Platform mode and 23/23 in Token mode, covering audit, scan, auth, dependency chains and BOLA/BFLA, including rejection of the HTTP-200 false positive. The port is complete and version-aligned with the sibling plugins.

Worth knowing

The skills were not tested in a live Cursor session because the Cursor CLI agent isn't installed in the author's environment, and the Windows PowerShell blocks were also untested. The port relies on hunk-by-hunk translation from Claude's text, so drift between the two plugins is only caught by the divergence check. GraphQL coverage in Token mode is limited to the default SQG policy, with no tag-based SQGs.

Wiring

Work starts from the Claude plugin's v1.16.0 → v1.17.0 diff as the source of truth. Each hunk is matched against the Cursor plugin's current text and rewritten in Cursor conventions before applying, so Cursor-specific wording (AskQuestion, conversational credential asks) is preserved rather than overwritten. A divergence check compares Cursor against Claude afterward to confirm only the intended differences remain. Validation runs via node scripts/validate-template.mjs, which is expected to warn only about absent hooks and MCP files. The GraphQL test suite shared with the other plugins runs against the updated docs on 42c-ast 3.60.3 in both Platform and Token modes, exercising audit, scan, auth, dependency chains and BOLA/BFLA. Version and license metadata are updated in the plugin manifest, and README/RECIPES are regenerated from the current text.

Try it yourself

Bring the Cursor plugin in this repo from v1.16.0 to v1.17.0 by porting the Claude plugin's 1.16.1 fixes and 1.17.0 GraphQL support. Translate each change into Cursor wording and apply it hunk by hunk against Cursor's current text. Fix the scan happy-path check, the status-12 re-run failure from 42c-ast not overwriting --output, the literal $OUTPUT_DIR in the quoted heredoc, and the pre-flight reference to the removed code-to-oas skill. Add the GraphQL schema audit and live GraphQL scan with BOLA/BFLA, including a confirmation step that validates authorization findings against response data to reject HTTP-200 false positives. Use AskQuestion for multiple-choice prompts and ask conversationally for tokens, API keys, URLs and test values. Replace AskUserQuestion in token-limit.md, fix source=claude Free Trial links, update README and RECIPES, set version 1.17.0 and license Apache-2.0. Then run node scripts/validate-template.mjs and the GraphQL test suite in Platform and Token modes.