Environment Variables
Required
| Variable | Description |
|---|---|
PRISMA_AIRS_API_KEY | Prisma AIRS API key (x-pan-token). Used for authentication. |
Optional
| Variable | Default | Description |
|---|---|---|
PRISMA_AIRS_PROFILE_NAME | Cursor IDE - Hooks | AIRS security profile name for all scan directions |
PRISMA_AIRS_API_ENDPOINT | https://service.api.aisecurity.paloaltonetworks.com | Regional AIRS API base URL |
PRISMA_AIRS_PROMPT_PROFILE | (inherits PRISMA_AIRS_PROFILE_NAME) | Override profile for prompt scanning |
PRISMA_AIRS_RESPONSE_PROFILE | (inherits PRISMA_AIRS_PROFILE_NAME) | Override profile for response scanning |
PRISMA_AIRS_TOOL_PROFILE | (inherits PRISMA_AIRS_PROFILE_NAME) | Override profile for MCP/tool scanning |
Cursor-Provided
These are injected by Cursor when running hooks and used internally:
| Variable | Description |
|---|---|
CURSOR_PROJECT_DIR | Absolute path to the current workspace |
CURSOR_USER_EMAIL | Authenticated user's email (if available) |
CURSOR_VERSION | Cursor IDE version string |
User Identity Resolution
Every AIRS scan includes a metadata.app_user field that identifies the developer. This appears as the user_id in AIRS scan logs and the Strata Cloud Manager console, enabling per-user audit trails and policy enforcement.
The identity is resolved using the following fallback chain:
| Priority | Source | Example |
|---|---|---|
| 1 | user_email from Cursor hook stdin | calvin@cdot.io |
| 2 | git config user.email (shell exec) | calvin@example.com |
| 3 | $USER or $USERNAME env var | cdot |
| 4 | Hardcoded fallback | unknown |
The resolved value is sent to AIRS as:
{
"metadata": {
"app_name": "cursor-ide",
"app_user": "calvin@cdot.io"
}
}
When you're signed into Cursor, it injects your account email into every hook invocation via the user_email field in the stdin JSON. Both hooks (beforeSubmitPrompt and afterAgentResponse) write this to process.env.CURSOR_USER_EMAIL, which the scanner then reads as the first-priority identity source.
Setting Variables
macOS / Linux (zsh)
# Add to ~/.zshrc or ~/.zsh.d/20-exports.zsh
export PRISMA_AIRS_API_KEY="your-key-here"
export PRISMA_AIRS_PROFILE_NAME="Cursor IDE - Hooks"
macOS / Linux (bash)
# Add to ~/.bashrc or ~/.bash_profile
export PRISMA_AIRS_API_KEY="your-key-here"
Cursor loads environment variables from your login shell on macOS. After changing shell exports, restart Cursor (not just reload the window) for the changes to take effect.