Cursor integration

Independent security around Cursor.

Code and dependency monitoring across Cursor work, with local edit and shell adapters available for setup.

Coverage is stated per surface. Native provider security remains a complementary layer.
Cursor coverage Current assessment
INTEGRATION PROFILE Beta
Provider
Cursor local and Background Agents
Primary transport
Workspace watcher and Cursor hooks
Workspace scanning
Available
Blanket runtime protection
Not claimed

Provider versions, host configuration and remote execution mode can change effective coverage.

Coverage detail

What the integration can see and where it stops.

This profile distinguishes workspace observation from pre-execution control. An observed effect is not evidence that the original action was prevented.

OBSERVE

Evidence CodeMarine can inspect

  • Local workspace edits and generated files
  • Shell events exposed by the Cursor hook surface
  • Dependency, MCP and project instruction changes
PREVENTIVE PATH

Defined blocking potential

  • Supported local shell and write operations after setup
LIMITS

What you should not assume

  • No live canary means active host invocation is not yet proof-backed
  • Background Agents run remotely and need a future sidecar or gateway
  • Native MCP coverage is expanding
Use both layers

Native controls protect Cursor. CodeMarine protects the shared environment.

Provider permissions, sandboxes and security review remain useful. CodeMarine adds one deterministic policy and evidence model around the workspace used by this provider and the rest of your stack.

NATIVE LAYERProvider permissions and containment

Controls the surfaces and execution modes owned by the provider.

CODEMARINE LAYERCross-provider workspace policy

Secures resulting code, software supply chain and supported actions under one control model.

Effective protection

A configured adapter is only the start.

The target product state requires the right adapter, current configuration, workspace identity, healthy decision path and a matching live-host proof.

The live canary does not exist yet. Current adapters must remain Setup needed or Beta until host invocation can be proven.

  1. 01

    InstallPlace the supported adapter and configuration.

  2. 02

    VerifyCheck version, integrity and workspace binding.

  3. 03

    ProveRun a harmless nonce-bound canary through the real host.

  4. 04

    MaintainExpire proof when the host, policy or configuration changes.

Early access

Evaluate CodeMarine with Cursor.

Map the current workspace, provider paths and limits before deciding which controls to rely on.

Sarge, the CodeMarine guardian