Cursor Setup

AgentKeeper hooks into Cursor's tool use lifecycle so teams can enable Composer or Agent Chat with policy checks around shell commands, MCP tool calls, file access, prompts, and Cursor's generic preToolUse payloads before execution.

Cursor's current docs include generic, shell, MCP, file, prompt, stop, session, MDM, and Enterprise cloud hook distribution. Validate the exact Cursor app or CLI version before promising parity, because CLI event coverage has historically differed from the desktop app.

Use Policy outcomes for the shared Monitor, Warn, and Block model; this page lists what the Cursor surface can actually support.

What gets monitored

For maximum parity, test Cursor's generic preToolUse and file-specific events in the customer's app build before rollout. Cursor's shell and MCP paths can block through the hooks below.

Installation

Get your API key from Settings > Access > API keys in the dashboard, then run the installer:

export AGENTKEEPER_API_URL="https://www.agentkeeper.dev"
export AGENTKEEPER_API_KEY="ak_live_..."
bash <(curl -fsSL "$AGENTKEEPER_API_URL/install-hooks.sh") --ide cursor

The installer stores the API key in ~/.agentkeeper/config, installs ~/.cursor/hooks/agentkeeper-hook.sh, and merges AgentKeeper commands into ~/.cursor/hooks.json.

What gets generated

{
  "version": 1,
  "hooks": {
    "preToolUse": [
      {
        "command": "bash ~/.cursor/hooks/agentkeeper-hook.sh",
        "failClosed": false
      }
    ],
    "beforeShellExecution": [
      {
        "command": "bash ~/.cursor/hooks/agentkeeper-hook.sh",
        "failClosed": false
      }
    ],
    "beforeMCPExecution": [
      {
        "command": "bash ~/.cursor/hooks/agentkeeper-hook.sh",
        "failClosed": false
      }
    ],
    "beforeReadFile": [
      {
        "command": "bash ~/.cursor/hooks/agentkeeper-hook.sh",
        "failClosed": false
      }
    ],
    "afterFileEdit": [
      {
        "command": "bash ~/.cursor/hooks/agentkeeper-hook.sh",
        "failClosed": false
      }
    ],
    "beforeSubmitPrompt": [
      {
        "command": "bash ~/.cursor/hooks/agentkeeper-hook.sh",
        "failClosed": false
      }
    ]
  }
}

For team rollout, deploy the same hook file and ~/.cursor/hooks.json through your device management tool, or package a repo-level config after validating it in a test workspace.

Connecting to the dashboard

After running the installer, open Cursor and start a Composer session. AgentKeeper registers the workstation on the first event. You can verify coverage in the Workstations page of your dashboard within a few seconds.

Known limitations

Version validation. Cursor documents file, prompt, stop, session, and tab hooks, but event availability can differ by product surface. Validate app and CLI coverage separately.

Enterprise distribution. Cursor supports MDM file deployment and Enterprise cloud hook distribution. AgentKeeper status scripts should verify the local hooks.json, hook script path, and last live event.

Restart after hook changes. Cursor reads hook config when the agent session starts. Fully restart Cursor if a new or changed hook does not fire.

Exit-code blocking. AgentKeeper returns exit code 2 for denied Cursor actions, which Cursor treats as a blocking decision on hook events that support blocking.

Outcome support status

For cross-IDE claims, see IDE runtime parity.