Skip to main content

Environment Variables

Required

VariableDescription
PRISMA_AIRS_API_KEYPrisma AIRS API key (x-pan-token). Used for authentication.

Optional

VariableDefaultDescription
PRISMA_AIRS_PROFILE_NAMECursor IDE - HooksAIRS security profile name for all scan directions
PRISMA_AIRS_API_ENDPOINThttps://service.api.aisecurity.paloaltonetworks.comRegional AIRS API base URL
PRISMA_AIRS_PROMPT_PROFILE(inherits PRISMA_AIRS_PROFILE_NAME)Override profile for prompt scanning
PRISMA_AIRS_RESPONSE_PROFILE(inherits PRISMA_AIRS_PROFILE_NAME)Override profile for response scanning
PRISMA_AIRS_TOOL_PROFILE(inherits PRISMA_AIRS_PROFILE_NAME)Override profile for MCP/tool scanning

Cursor-Provided

These are injected by Cursor when running hooks and used internally:

VariableDescription
CURSOR_PROJECT_DIRAbsolute path to the current workspace
CURSOR_USER_EMAILAuthenticated user's email (if available)
CURSOR_VERSIONCursor IDE version string

User Identity Resolution

Every AIRS scan includes a metadata.app_user field that identifies the developer. This appears as the user_id in AIRS scan logs and the Strata Cloud Manager console, enabling per-user audit trails and policy enforcement.

The identity is resolved using the following fallback chain:

PrioritySourceExample
1user_email from Cursor hook stdincalvin@cdot.io
2git config user.email (shell exec)calvin@example.com
3$USER or $USERNAME env varcdot
4Hardcoded fallbackunknown

The resolved value is sent to AIRS as:

{
"metadata": {
"app_name": "cursor-ide",
"app_user": "calvin@cdot.io"
}
}
How it works in practice

When you're signed into Cursor, it injects your account email into every hook invocation via the user_email field in the stdin JSON. Both hooks (beforeSubmitPrompt and afterAgentResponse) write this to process.env.CURSOR_USER_EMAIL, which the scanner then reads as the first-priority identity source.

Setting Variables

macOS / Linux (zsh)

# Add to ~/.zshrc or ~/.zsh.d/20-exports.zsh
export PRISMA_AIRS_API_KEY="your-key-here"
export PRISMA_AIRS_PROFILE_NAME="Cursor IDE - Hooks"

macOS / Linux (bash)

# Add to ~/.bashrc or ~/.bash_profile
export PRISMA_AIRS_API_KEY="your-key-here"
Cursor inherits your shell environment

Cursor loads environment variables from your login shell on macOS. After changing shell exports, restart Cursor (not just reload the window) for the changes to take effect.