Cursor

MCP servers connect the agent to external tools and data over stdio, SSE or Streamable HTTP with OAuth for remote servers, installed one click from the Cursor Marketplace or configured in mcp.json, and team admins can distribute servers through a team marketplace; tools, prompts, resources and elicitation are supported.

Sourcecursor.com/docs/mcpread 2026-09-29

The agent delegates to subagents that each run in their own context window, in the foreground or in the background and in parallel, with built in Explore, Bash and Browser subagents and custom subagents defined with their own prompts, tool access and models, in the editor, the CLI and Cloud Agents.

Sourcecursor.com/docs/subagentsread 2026-09-29

The agent finds code with Instant Grep, an exact match and regex search engine that builds and queries its index on the developer's machine, and an Explore subagent that runs parallel searches per task; files, folders and past chats are attached per conversation with @ mentions. The docs state Cursor does not store embeddings of the codebase for search, so context is assembled per run, and the local grep index is a search accelerator rather than a persistent knowledge index.

Sourcecursor.com/docs/agent/tools/search and help/customization/contextread 2026-09-29

Run Modes decide when the agent stops for approval on shell, MCP and fetch calls: Allowlist runs only listed actions without asking, Auto-review sandboxes shell commands and sends other calls to a classifier that can ask the user to approve, plain English block instructions route named actions to approval, and a team configuration set in the dashboard overrides user and project settings; browser tools require approval by default.

Sourcecursor.com/docs/agent/security/run-modes and docs/agent/tools/browserread 2026-09-29

Cursor holds a SOC 2 Type II attestation and AIUC-1, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications, with certificates and reports available on request at trust.cursor.com, and documents SSO, SCIM and enforced multi factor authentication; the pricing page adds SAML/OIDC SSO on Teams and SCIM, repository and model access controls and audit logs on Enterprise.

Sourcecursor.com/security and cursor.com/pricingread 2026-09-29

Hooks fire on every step of the agent loop (preToolUse and postToolUse, shell and MCP execution before and after, file reads and edits, subagent start and stop, agent responses and thoughts), the docs name auditing as a use, and Enterprise admins distribute team hooks from the dashboard; the Admin API returns per request usage events with model, tokens and conversation ID, while its audit log covers logins, user and settings changes rather than agent actions. Turning the per step hook record into an audit trail takes a log sink the buyer builds.

Sourcecursor.com/docs/hooks and docs/account/teams/admin-apiread 2026-09-29

Past agent transcripts can be searched from the Agents Window and attached to a new conversation with @Chats, and checkpoints snapshot modified files within a session. No memory layer with a stated scope and lifetime is documented, project rules are instructions the product applies, and subagents start without prior conversation history.

Sourcecursor.com/help/customization/context and docs/agent/overviewread 2026-09-29

Self-Hosted Machines move Cloud Agent tool execution to machines the customer manages, such as a Linux VM in the customer's AWS account, a Kubernetes cluster or its own devices, with the checkout, build cache and machine local credentials staying there (Team Pools on Enterprise). Cursor still runs the agent loop, inference and planning, and Enterprise customers can enroll in US only data residency.

Sourcecursor.com/docs/cloud-agent/self-hosted and help/security-and-privacy/regionsread 2026-09-29

Plugins bundle rules, skills, agents, commands, MCP servers and hooks, and the Cursor Marketplace lists manually reviewed official plugins installed per project or user from Customize, including Amplitude, Datadog, Figma, Linear, Sentry, Stripe, Supabase and Vercel plugins that each do their own job; Teams and Enterprise can run private team marketplaces, and three subagents ship built in.

Sourcecursor.com/docs/plugins and cursor.com/marketplaceread 2026-09-29

Automations run cloud agents in the background on a schedule (preset or cron) or in response to events, a GitHub pull request opened or marked ready, Slack messages, Linear issue changes, PagerDuty incidents, Sentry errors and webhooks, with no person starting the run; Bugbot also reviews every pull request update automatically.

Sourcecursor.com/docs/cloud-agent/automations and docs/bugbotread 2026-09-29

Users pick the model per chat or agent from Anthropic, OpenAI, Google and xAI models alongside Cursor's own Composer models, or let Auto choose; team admins allow or block models in Team Settings, with the router falling back to an allowed model, and users can add their own provider API key.

Sourcecursor.com/help/models-and-usage/available-modelsread 2026-09-29

The Cloud Agents API at api.cursor.com, with Basic or Bearer authentication on user or service account keys, creates, lists, follows up, streams, cancels, archives and deletes agents and their runs and returns artifacts, and TypeScript and Python SDKs are published beside it.

Sourcecursor.com/docs/cloud-agent/api/endpointsread 2026-09-29

Bugbot reviews each pull request for bugs, security issues and quality problems and publishes a CI check status, and a custom verifier subagent can run the tests and report what passed. Both test the customer's code, and no harness, scored test set or optimization loop for evaluating the agent's own behavior is documented.

Sourcecursor.com/docs/bugbot and docs/subagentsread 2026-09-29

The browser tool lets the agent control a browser pane inside Cursor, navigating, clicking, typing, scrolling and taking screenshots to test applications, audit accessibility and check visual changes, through Cursor's own MCP server, with approval required by default and an admin origin allowlist; a built in Browser subagent runs these steps, and self hosted workers run computer use tools.

Sourcecursor.com/docs/agent/tools/browser and docs/subagentsread 2026-09-29