Cursor security settings
Cursor Security Settings: Top 10 for Admins
Cursor is an editor with an AI agent that runs on each developer's computer, on a personal plan (Pro) or managed by your company (Teams or Enterprise). These are the 10 settings that matter most, where to find each one and what good looks like.
In short: start with (1) Privacy Mode enforced, (2) SSO required and (3) MCP allowlist, then work down the list below.
By Jon Rose, Founder & Managing Partner, IOmergent. Vendor facts as of October 2026. Not sure which version you have? See which AI account is which.
The top 10 Cursor security settings
Most important first. Our free AI Hardening Check walks you through these and the other 10, with direct links, inside your own AI assistant.
-
1Privacy Mode enforced
- Where to find it
- cursor.com dashboard > Settings: Privacy Mode, with enforcement so members can't turn it off (Teams and Enterprise; on by default for Enterprise). MDM policy AllowedTeamId keeps personal accounts off work devices
- Good looks like
- On and enforced for the team. Cloud agents need Privacy Mode, not Privacy Mode (Legacy)
- Why it matters
- Keeps code from being stored or trained on
-
2SSO required
- Where to find it
- Team dashboard > Single Sign-On (SAML: Okta, Entra ID, Google Workspace, OneLogin). Docs say you can require SSO and block password sign-in
- Good looks like
- SSO required for every member, password sign-in blocked
- Why it matters
- Members sign in under company MFA and offboarding
-
3MCP allowlist (Enterprise only)
- Where to find it
- Team dashboard > MCP Configuration (Enterprise): approve servers by command or URL, a Tools field per server (empty allows all tools) and a network policy (Allow all, Allowlist, Deny all, No sandbox)
- Good looks like
- Allowlist set, tools narrowed, local servers never on No sandbox. Teams: no allowlist, so a reviewed list of approved servers and spot checks of mcp.json
- Why it matters
- Only reviewed servers run
-
4Agent run mode policy (Enterprise only)
- Where to find it
- Team dashboard run mode policy (Auto Run Configuration, Cursor 3.6+): Auto-review (default), Allowlist, Run Everything; it overrides user and project settings
- Good looks like
- Auto-review with sandboxing, Run Everything not allowed. Teams: no team switch, so each user keeps Auto-review in Settings > Agents > Approvals & Execution
- Why it matters
- Run Everything executes commands without review
-
5Local sandbox network and Read Controls
- Where to find it
- Admins set sandbox network rules in the dashboard (page not named). Team Settings > Security & automation > Read Controls: System or Workspace (Enterprise, Cursor 3.23+)
- Good looks like
- Sandbox network not Allow All; Read Controls set to Workspace
- Why it matters
- Limits what local agent commands can read and reach
-
6Repository blocklist and .cursor Directory Protection (Enterprise only)
- Where to find it
- Team dashboard: Repository Blocklist (editor and CLI only, not Cloud Agents or Bugbot) and .cursor Directory Protection (agents need approval to change .cursor rules and settings)
- Good looks like
- Sensitive repositories blocklisted and .cursor protection on
- Why it matters
- Keeps agents out of restricted repos and stops them rewriting their own rules
-
7Hooks for agent actions (team hooks Enterprise only)
- Where to find it
- Dashboard team hooks (Enterprise; they fail open, no failClosed). MDM hooks.json: /Library/Application Support/Cursor/, /etc/cursor/, C:\ProgramData\Cursor\. Events include beforeShellExecution, beforeMCPExecution, beforeReadFile
- Good looks like
- MDM hooks.json with failClosed true on beforeShellExecution and beforeMCPExecution. Teams: no team hooks, so a reviewed project hooks.json
- Why it matters
- Hooks are the only hard block on commands and MCP calls
-
8Cloud agent network access
- Where to find it
- Cloud agent network settings: 'Allow all network access', 'Default + allowlist', 'Allowlist only'; Enterprise can 'Lock Network Access Policy'. Internet is on by default and cloud agents run every command without asking
- Good looks like
- Allowlist only and locked (Enterprise), or cloud agents off where code may not leave
- Why it matters
- Auto-run plus open internet invites prompt injection exfiltration
-
9Model access and personal API keys (Enterprise only)
- Where to find it
- Team Settings > Models: Cursor Models, Other Models, Model Defaults, and Personal API Keys (BYOK); groups can only widen access. New models are off for Enterprise until enabled. Keep Claude 4.5 Haiku on or Auto-review stops
- Good looks like
- Approved models only, strictest default on the team, BYOK off. Teams: a written model policy
- Why it matters
- Cursor's zero retention deals do not cover personal API keys
-
10Audit log (Enterprise only)
- Where to find it
- Team dashboard audit log with CSV export; streaming to Splunk, Sumo Logic, webhook or S3 set up through [email protected]; API GET /teams/audit-logs. Not logged: prompts, generated code, failed sign-ins
- Good looks like
- Streamed to your SIEM. Teams: no audit log, so review members and settings monthly
- Why it matters
- Shows sign-ins, role, key and settings changes
Cursor security settings: common questions
- What are the most important Cursor security settings?
- Start with (1) Privacy Mode enforced, (2) SSO required and (3) MCP allowlist. All 10 are listed on this page, most important first, with where to find each one and what good looks like.
- How can I check all the Cursor settings quickly?
- Add the free IOmergent AI Hardening Check to your AI assistant and ask: "Run the IOmergent AI Hardening Check for our Cursor team." It walks you through these and the other 10, with direct links, and nothing leaves your machine without your OK.
Want an expert review?
A self-check can't see which AI apps hold OAuth access to your email, files and code, or confirm the settings match what was reported. Our AI Security Assessment does both, with read-only connections and a live review.
See the AI Security Assessment