Approvals switched off
Run Everything in the editor, "approvalMode": "unrestricted" in the CLI, or agent --force / --yolo / --approve-mcps in an alias or script.
AI coding agents · Cursor
What Cursor can do without asking, and how to lock it down
Cursor's agent runs commands through a Run Mode, and its CLI through cli-config.json. A repo you clone can add its own allowlists, hooks and sandbox settings on top of yours.
~/.cursor/cli-config.json −risky+fixed−"approvalMode": "unrestricted",−"permissions": { "allow": ["Shell(*)"] }+"approvalMode": "allowlist",+"permissions": { "allow": ["Shell(git)"], "deny": ["Shell(rm)"] }
Where Cursor keeps its settings
~ is your home folder on every OS. Project files come with the repo.
| Scope | File | What's in it |
|---|---|---|
| MCP servers | ~/.cursor/mcp.json.cursor/mcp.json | Servers it starts: command, args, env, url, headers. |
| Hooks | ~/.cursor/hooks.json.cursor/hooks.json | Commands run on agent events, without asking. |
| CLI settings | ~/.cursor/cli-config.json.cursor/cli.json | approvalMode, sandbox, and permissions.allow / deny. |
| Editor allowlists | ~/.cursor/permissions.json.cursor/permissions.json | terminalAllowlist, mcpAllowlist. A project's entries are added to yours. |
| Sandbox | ~/.cursor/sandbox.json.cursor/sandbox.json | type, networkPolicy, readBoundary. The project file takes priority. |
| Rules and instructions | .cursor/rules/*.mdcAGENTS.md | Read at the start of a chat; alwaysApply: true means every chat. |
What each Run Mode lets it do
Settings › Agents › Approvals & Execution in the editor; approvalMode in the CLI.
| Mode | What runs without asking |
|---|---|
Auto-review | Allowlisted calls run at once; others run in the sandbox when they can, the rest go to a classifier. Cursor: "not a security boundary". The default since 3.6. |
Allowlist | Only what is on your allowlist. With an empty list, everything asks. |
Run Everything | Every tool call runs automatically, with no sandbox. The old YOLO mode. |
agent --force · --yolo | The CLI: allow commands unless explicitly denied. |
Six things to check
Wide CLI grants
Shell(*), WebFetch(*) or Mcp(*:*). In Cursor Shell(x) allows x with any arguments, so Shell(bash) or Shell(python3) already means any script.
A repo that loosens things for you
A project's permissions.json adds to your allowlists; its sandbox.json with "type": "insecure_none" turns the sandbox off.
Hooks that download, send or approve
curl … | sh in a hook, a hook that posts data, or one that answers "permission": "allow" for you.
Keys in mcp.json
A token in env or headers. Cursor's own advice: use ${env:NAME}, never the value.
Rules that tell it to run things
Instructions to curl … | sh, or invisible characters, in .cursor/rules, AGENTS.md or .cursorrules.
Lock the CLI down
In ~/.cursor/cli-config.json (plain JSON; version and editor.vimMode are required). In the editor, pick Allowlist, never Run Everything.
{
"version": 1,
"editor": { "vimMode": false },
"approvalMode": "allowlist",
"sandbox": { "readBoundary": "workspace" },
"permissions": {
"allow": [],
"deny": ["Shell(rm)", "Read(.env*)", "Write(**/.env*)", "Write(**/*.key)"]
}
} Nothing runs unprompted, reads outside the project ask first, and rm, .env and key files stay refused even under --force: deny wins over allow.
Or check all of it at once
For Cursor, NeuroShield reads mcp.json, hooks.json, cli-config.json, each project's .cursor/cli.json, rules and extensions: wide grants, keys in MCP configs, hooks that download or send, and hidden characters.
Read only
It reads settings files and never runs your agents, their MCP servers or their scripts.
Nothing leaves this computer
The check runs locally. No account, no upload, no AI inside: fixed, published rules.
Nothing changes without your OK
Where a safe fix exists, Fix It for Me makes it after you confirm, with a backup and Undo.
Questions
What happened to Cursor's YOLO mode?
In the editor it is Run Everything; in the CLI --yolo is an alias for --force.
Where is Cursor's mcp.json?
~/.cursor/mcp.json for every project, .cursor/mcp.json inside one. The CLI uses the same files.
Does .cursorignore keep secrets from the agent?
Only partly: Cursor says the terminal and MCP tools the agent uses can't be blocked by it.
See your own agents
The check is free: how many agents you have and what they can do. Details and fixes come with Shields.