Integration · Cursor
Secure Cursor agents with a local execution gate
Cursor’s agent mode executes multi-step plans with write access to your repo and shell. It does not know your infrastructure boundaries, your compliance windows, or which database is production, and rules files are advisory, not enforced.
Mergen sits between Cursor and your systems as a local execution gate. Policy is evaluated deterministically in under 1ms per call: no LLM in the critical path, no cloud round-trip, and all data stays on your machine.
What is covered, precisely
- Cursor edits are covered by a detect-and-revert self-heal (`afterFileEdit`): Cursor has no pre-write hook at the platform level, so the bad content briefly lands on disk before Mergen reverts it. A materially weaker guarantee than a block, never described as one.
- Commands run outside this surface are not intercepted: wrap those in `mergen-server exec -- <cmd>` for the same gate.
Set up in two minutes
Install the server
npm install -g mergen-serverConfigure Cursor (installs the afterFileEdit hook)
mergen-server setupStart the gate
mergen-server startWhat gets stopped
rm -rf / (and obfuscated variants)Hard safety policy; the benchmark corpus tracks obfuscation and encoding evasions.
kubectl delete namespace productionBlast-radius rules distinguish a namespace delete from a pod restart.
aws iam create-access-keyCredential-surface changes escalate to HOLD for human review.
Human-in-the-loop approvals
Held calls fire a Slack webhook with one-click approve/deny. The Promise stays suspended until a human decides (or the 15-minute fail-closed auto-deny fires), then Cursor’s call resumes or receives a structured denial.