Loading…
investigate-alerts
Cursor Command
Investigate active and historical ZDX alerts to understand scope, root cause, and impact.
Manage the Zscaler cloud security platform including ZPA (private access), ZIA (internet access), ZDX (digital experience), ZCC (client connector), EASM (attack surface management), and Z-Insights (security analytics). Includes guided skills for application onboarding, policy audits, incident investigation, and cross-product troubleshooting.
Commands20
app-healthAnalyze application health across the organization using ZDX scores and metrics.
audit-softwareAudit software inventory across devices using ZDX data for compliance and vulnerability assessment.
audit-sslAudit ZIA SSL inspection rules -- list rules by action (INSPECT, DO_NOT_INSPECT, DO_NOT_DECRYPT, BLOCK), identify bypasses, and assess risk.
check-accessCheck whether a user or group can access a specific URL via ZIA policies.
compare-locationsCompare digital experience across locations, departments, or geolocations using ZDX.
Rules7
cross-service-overlapZscaler APIs have intentional cross-service data overlap. Disabling a service does not remove overlapping tools from other services.
write-operation-safetyWrite operations are disabled by default and require explicit enablement. Delete operations use HMAC confirmation tokens.
zdx-read-onlyZDX is a read-only monitoring service. The since parameter is in hours, not timestamps.
zia-activation-requiredZIA requires explicit activation after any create, update, or delete operation. Forgetting this is the number one source of issues.
zms-graphql-conventionsZMS uses GraphQL and is read-only. Every query requires ZSCALER_CUSTOMER_ID and uses specific pagination patterns.
Related plugins
Browserless
Browser automation tool for AI agents: web scraping, crawling, and web search, with built-in stealth features by running headless browsers in the Browserless cloud
Turso
Manage Turso Cloud (organizations, databases, groups) and run SQL from Cursor via the hosted Turso MCP server — OAuth login, no API token to copy.
incident.io
Makes your agent fluent in incident.io: responding to and investigating incidents, working with on-call schedules and escalations, and authoring the operational content — runbooks, skills, and plugins — that incident.io investigations draw on. Bundles the official incident.io MCP server.
GoDaddy
Brainstorm domain names and check availability.
Railway
Railway agent skills and hosted MCP server for deploying, configuring, monitoring, and troubleshooting apps and infrastructure on Railway from Cursor. Manage services, environments, deployments, databases, object storage, networking, and observability.
AWS Core
Build, deploy, and operate applications on AWS. Skills to author infrastructure-as-code (CDK, CloudFormation), use core services (Lambda, API Gateway, Step Functions, ECS/Fargate, ECR, IAM, Amazon Bedrock with Knowledge Bases and Guardrails, AWS Blocks), select and operate databases across relational, key-value, document, wide-column, graph, time-series, and in-memory engines (Aurora PostgreSQL/MySQL, Aurora DSQL, RDS, Oracle Database@AWS, DynamoDB, DocumentDB, Keyspaces, Neptune, Timestream, ElastiCache, and MemoryDB), and complete common tasks across observability (CloudWatch, X-Ray, CloudTrail, ADOT), messaging and streaming (SQS, SNS, EventBridge, Kinesis, MSK), AWS SDKs (boto3, JS v3, Swift), and cost optimization.