Blekline ships deterministic enforcement for Cursor IDE via hooks, MCP proxy, and (for production agents) ingress proxy. This page is the DPO-facing guarantee matrix — what is enforced, where, and what remains a soft control.
Minimum Cursor version: 0.3.36+ (hooks UI + execution log).
Three surfaces (do not conflate)
| Surface | Chat mask on Send | MCP exec guard | Shell guard | Read .env block |
|---|---|---|---|---|
| Cursor IDE (Agent/Composer) | Yes | Yes | Yes | Yes |
| Cursor Cloud Agent | No | No (not wired by Cursor yet) | Yes | Yes |
| Tab inline completions | N/A | N/A | N/A | Roadmap (beforeTabFileRead) |
| Production SDK/agent | Yes (ingress) | Yes (proxy/SDK) | Your CI policy | Your policy |
Cursor IDE governance ≠ full enterprise agent governance. Production customer-care / SDK agents must use Ingress proxy or SDK mask() + enforceToolCall().
Layer model
| Layer | Mechanism | Audit-grade? |
|---|---|---|
| L1 Enforced | Cursor hooks + MCP proxy + ingress | Yes |
| L2 Routing | Sensitive tools via blekline-proxy; prod LLM via ingress base URL | Yes |
| L3 Soft | Project rules + MCP tools the agent may call | No — backup only |
Rules encourage good behavior; they are not compliance controls.
Hook inventory
Install via pnpm generate:mcp-configs --local (monorepo) or @blekline/cursor-hooks from blekline-oss.
| Hook | Enforces |
|---|---|
beforeSubmitPrompt | Cloud mask; block raw prompt; clipboard safe text; block sensitive attachments |
beforeReadFile | Deny .env, keys, credentials paths (failClosed: true) |
beforeShellExecution | Deny cat .env, secret patterns in commands (failClosed: true) |
preToolUse | Deny Read on sensitive paths; redact Write content via updated_input |
beforeMCPExecution | Local + cloud enforce; deny unproxied MCP with secrets (failClosed: true) |
afterShellExecution | Metadata audit if command output contains secret patterns |
sessionStart | Inject workspace token env + agent context |
Hooks must use shell wrapper paths (.cursor/hooks/blekline-*.sh), not bare node + args.
Enterprise preset
.blekline/cursor.json:
{
"enterprisePreset": true,
"promptPolicy": "auto_mask",
"shellGuard": true,
"toolGuard": true,
"mcpGuard": true,
"shellGuardMode": "local",
"failClosed": true,
"copyMaskedToClipboard": true,
"emitAuditEvents": true,
"showMaskedInUi": false
}
enterprisePreset: true enables all guards and failClosed on security hooks.
Chat send flow (IDE)
- User sends secrets → blocked (never hits model)
- Short notice + trace ID; masked text on clipboard (default)
- Cmd+V + Enter → passthrough allows safe version
- Metadata events → workspace Activity (
cursor_prompt_governance)
Silent auto-send in native Cursor chat is not available — Cursor's hook schema does not allow in-place prompt rewrite.
Residual gaps (honest)
- Cloud Agents: no
beforeSubmitPromptorbeforeMCPExecution— use ingress for production - Tab completions: not covered by current hooks
- User disables hooks: requires Cursor Enterprise team hooks / MDM
- Native Cursor model HTTP: not wrapped — only hook + MCP paths
Platform notes
| OS | Support |
|---|---|
| macOS | Full (tested) |
| Linux | Full (.sh hooks) |
| Windows | Use Git Bash/WSL for .sh hooks; native .cmd wrappers on roadmap |
Token scopes
Workspace token needs mask:write and events:write. Use a dedicated eval workspace per customer — not shared sample tenants.
10-step verification
- MCP green:
blekline+blekline-proxy - Hooks: 7
.cursor/hooks/blekline-*.shentries (not barenode) - Chat block: secrets in Send → blocked + clipboard
- Chat passthrough: Cmd+V + Enter → allowed
- MCP:
blekline_mask_prompt→ masked JSON - Proxy: write with secrets → block/mask
- Read deny: agent Read
.env→ denied - Shell deny:
cat .env→ denied - Write redact: Write with API key → redacted args
- Activity: metadata only; trace ID from block notice
pnpm build:packages
pnpm generate:mcp-configs --local
pnpm demo:cursor-hook-smoke
pnpm demo:mcp-smoke
Next: Trust boundaries · Cursor MCP setup · Ingress proxy