Integration · Cursor

Governing Cursor with Alyria

Cursor enterprise security rests on controls Anysphere documents directly: enforced Privacy Mode, Auto-review with sandboxing, lifecycle hooks with failClosed, an MCP allowlist, and .cursorignore for secrets. Anysphere's documentation describes most of these as best-effort guardrails and tells you to pair them with deterministic ones like hooks. Alyria Beacon is that deterministic layer at the endpoint: one inventory, policy and audit chain for Cursor and every other agent on the machine.

What Anysphere provides natively

Start with the vendor's own controls.

Each control below is named the way Anyspherenames it, and links to the vendor's documentation. Deploy them: they are the fastest path to a working baseline.

Enforced Privacy Mode

Org-wide enforcement so members cannot disable Privacy Mode or its zero data retention commitments for Cursor-routed models. Enterprise features are set in the team dashboard or through MDM.

Security and privacy hardening

Auto-review Run Mode

Runs allowlisted calls, sandboxes shell commands when it can, and routes the rest through a best-effort classifier. Anysphere recommends combining it with hooks rather than relying on either alone.

Run modes and sandboxing

Hooks with failClosed

Enforce and observe at agent lifecycle points (block commands, scrub secrets, audit), distributed by MDM or cloud, with failClosed for critical hooks.

Hooks

MCP allowlist and per-server network policy

Approve servers with the allowlist, restrict per-server tools, and apply network modes per server. The hardening guide groups the MCP allowlist with best-effort guardrails.

Model and integration management

.cursorignore

Blocks agent read and context for secrets and regulated trees. The reference notes terminal and MCP tools cannot honor it, so it pairs with approvals and file permissions.

Ignore files

Identity and tenancy

SSO, SCIM, Allowed Team IDs over MDM, restricted extensions, tenancy restriction at a TLS-terminating proxy, and audit log streaming to a SIEM.

Security and privacy hardening

Where they stop

What the native controls leave uncovered.

Drawn from what Anysphere states about its own limits, not from us.

Most guardrails are deliberately best-effort

Anysphere's hardening guide scopes its own controls: it pairs best-effort guardrails (Auto-review, allowlists, .cursorignore) with deterministic ones (approvals, hooks, sandboxing) rather than relying on a single layer, and Team Rules steer while the engine-level rules are treated as suggestions, not enforcement.

Everything is per-agent

These controls bind Cursor's own surfaces. An allowed extensions list does not govern the standalone model CLI your developers also use, and a Cursor MCP allowlist does not inventory the servers your other clients connect to. Cursor's own guide says to align agent traffic with your endpoint security; fleet inventory still needs endpoint tooling.

Local execution and the terminal

Cloud agent egress can be locked to an allowlist, and local sandboxing shields shell commands when it runs. What remains is the endpoint itself: an agent process with your developer's permissions touching .env files, keys and MCP servers that no Cursor setting observes.

Baseline configuration

A practical starting point.

The secret blocklist every Cursor repo should start with:

.cursorignore

.env
.env.*
secrets/
id_rsa*
*.pem
.aws/config
.aws/credentials

Coverage

What Anysphere's controls cover, and what the endpoint adds

Area	Cursor native controls	Endpoint governance with Alyria
MCP servers	MCP allowlist and per-server network modes inside Cursor; extended by Cloud Agent network egress policy.	Inventory of every configured server across every client on the machine, with monitor-first Lyra policy on each MCP call and no cloud round-trip.
Secrets and regulated files	.cursorignore blocks read and context for listed paths; terminal and MCP tools cannot honor it.	Endpoint policy that blocks the read-then-send sequence across agents, plus Umbra short-lived leases instead of standing credentials.
Model and tool calls	Auto-review rules for approval behavior; best-effort classifier on the rest.	Deterministic policy on every model and tool call, written once in a language you can test.
Audit trail	Audit log streaming for auth and admin events; OpenTelemetry export for usage; hooks for development-activity metadata.	One signed, tamper-evident chain covering decisions and MCP activity across Cursor and other tools, exportable to your SIEM.
Beyond Cursor	Out of scope: these controls govern Cursor surfaces.	One policy and one audit chain covering Claude Code, Cursor, Codex, GitHub Copilot and more.

The endpoint layer

What Alyria Beacon adds.

Governance at the endpoint, not the gateway: the same policy, secrets and audit whether the agent is Cursor or something ships next quarter.

Alyria Beacon complements the MDM policy: one signed, user-space agent, no kernel driver, read-only install, monitor mode first.
It inventories every AI tool, version and MCP server on the machine, including the ones no Cursor allowlist covers.
Lyra policies are code, so the rule you wrote for Cursor runs unchanged for other agents; sequence policies cover multi-step flows.
Every decision lands in one signed, hash-chained audit record, and Spectra exports the same signal to your SIEM.
Umbra brokers short-lived credential leases at the moment of use, so agents never hold standing credentials.

FAQ

Questions security teams ask about Cursor and Alyria.

Should we enable Auto-review or run Alyria Beacon?

Both, and Anysphere's docs say the same: pair best-effort guardrails with deterministic enforcement. Auto-review decides inside Cursor; Alyria Beacon applies the written policy at the endpoint across every agent, which no editor setting can reach.

What does Alyria add to the Cursor MCP allowlist?

The allowlist restricts what Cursor will connect to. Alyria Beacon inventories every server configured for every AI client on the machine, including stdio servers that never touch the network, evaluates each call against written policy, and keeps the evidence.

Does this replace Privacy Mode enforcement?

No. Enforce Privacy Mode through the dashboard as Anysphere recommends. It governs what data goes into Cursor-routed models; Alyria Beacon governs what agents do on the endpoint.

Other coding agents

Claude CodeAnthropic CodexOpenAI GitHub CopilotGitHub All integrationsBack to the overview

For your security team

Native controls: Dashboard and MDM org policies; hooks; MCP allowlist
MCP enforcement: Allowlist plus per-server network modes, best-effort
Endpoint layer: Alyria Beacon: signed, user-space, no kernel driver
Rollout: Read-only install, monitor mode first
Audit: Signed, hash-chained chain; OTel export via Spectra

See what your agents are wired to.

Start in monitor mode: inventory the AI tools, versions and MCP servers on every endpoint, see what enforcement would decide, and turn on enforcement when you are ready.

Get started About Alyria Beacon