Secure Cursor agents with a local execution gate
Cursor’s agent mode executes multi-step plans with write access to your repo and shell. It does not know your infrastructure boundaries, your compliance windows, or which database is production, and rules files are advisory, not enforced.
Mergen sits between Cursor and your systems as a local execution gate. Policy is evaluated deterministically on your machine in milliseconds: no LLM in the critical path and no cloud round-trip.
What is covered, precisely
- Shell commands are covered by Cursor’s `beforeShellExecution` hook, installed with `failClosed: true`: a true pre-execution block, the same tier as Claude Code. A BLOCK exits with code 2 and the command never runs.
- File edits are covered by a detect-and-revert self-heal (`afterFileEdit`): Cursor has no pre-write hook for edits, so the bad content briefly lands on disk before Mergen reverts it. A materially weaker guarantee than a block, never described as one.
- `mergen-server setup --ide=cursor` writes both hooks to `~/.cursor/hooks.json`, which is user-owned: an agent running as you could remove it. `sudo mergen interception deploy cursor` installs the same hooks at Cursor’s root-owned enterprise path instead. `mergen-server doctor` reports shell and edit coverage as separate checks.
- Commands run outside Cursor are outside this surface: wrap those in `mergen-server exec -- <cmd>` for the same gate.
Set up in two minutes
npm install -g mergen-servermergen-server setup --ide=cursormergen-server startWhat gets stopped
rm -rf / (and obfuscated variants)kubectl delete namespace productionaws iam create-access-keyHuman-in-the-loop approvals
A held shell command stops with the approval instructions. A human approves it from the CLI (`mergen approvals`), the local dashboard, or Slack on paid plans, and the same command goes through when Cursor runs it again. Holds fail closed: an unanswered hold auto-denies after 15 minutes, and every decision lands in the audit ledger.