Directory / Cursor Agent
Cursor Agent
Run modes decide what executes without asking. permissions.json holds terminal and MCP allowlists, sandbox.json sets network and path rules, and admins can push both. MCP tools do not run inside the local sandbox.
Lock this down first
Ship a team sandbox.json with networkPolicy default deny, and keep Run Everything off.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 3/3 | |
| Human approval gates | 2/3 | Auto-review uses a classifier for non-allowlisted calls. Allowlist mode with an empty list asks every time. |
| Sandboxing | 2/3 | Shell commands only. MCP tools run outside it. |
| Secrets handling | 1/3 | .cursorignore is documented as not a security boundary. Docs point you to file permissions and hooks. |
| Audit logs | 2/3 | Enterprise audit log covers admin and settings events, not agent actions. Hooks can log agent activity. |
| Kill switch / interrupt | Unverified | Not confirmed in the docs we checked. |
| Network egress control | 3/3 |
Sources
- https://cursor.com/docs/agent/security/run-modes
- https://cursor.com/docs/reference/permissions
- https://cursor.com/docs/reference/sandbox
- https://cursor.com/docs/enterprise/deployment-patterns
- https://cursor.com/docs/enterprise/compliance-and-monitoring
- https://cursor.com/docs/enterprise/llm-safety-and-controls
- https://cursor.com/docs/hooks