# Cursor enterprise governance

Blekline ships **deterministic enforcement** for Cursor IDE via hooks, MCP proxy, and (for production agents) ingress proxy. This page is the DPO-facing guarantee matrix — what is enforced, where, and what remains a soft control.

**Minimum Cursor version:** 0.3.36+ (hooks UI + execution log).

## Three surfaces (do not conflate)

| Surface | Chat mask on Send | MCP exec guard | Shell guard | Read `.env` block |
|---------|-------------------|----------------|-------------|-------------------|
| **Cursor IDE** (Agent/Composer) | Yes | Yes | Yes | Yes |
| **Cursor Cloud Agent** | No | No (not wired by Cursor yet) | Yes | Yes |
| **Tab inline completions** | N/A | N/A | N/A | Roadmap (`beforeTabFileRead`) |
| **Production SDK/agent** | Yes (ingress) | Yes (proxy/SDK) | Your CI policy | Your policy |

Cursor IDE governance ≠ full enterprise agent governance. Production customer-care / SDK agents must use **[Ingress proxy](/docs/api/ingress-proxy)** or SDK `mask()` + `enforceToolCall()`.

## Layer model

| Layer | Mechanism | Audit-grade? |
|-------|-----------|--------------|
| **L1 Enforced** | Cursor hooks + MCP proxy + ingress | Yes |
| **L2 Routing** | Sensitive tools via `blekline-proxy`; prod LLM via ingress base URL | Yes |
| **L3 Soft** | Project rules + MCP tools the agent may call | No — backup only |

Rules encourage good behavior; they are **not** compliance controls.

## Hook inventory

Install via `pnpm generate:mcp-configs --local` (monorepo) or `@blekline/cursor-hooks` from [blekline-oss](https://github.com/Blekline/blekline-oss).

| Hook | Enforces |
|------|----------|
| `beforeSubmitPrompt` | Cloud mask; block raw prompt; clipboard safe text; block sensitive **attachments** |
| `beforeReadFile` | Deny `.env`, keys, credentials paths (`failClosed: true`) |
| `beforeShellExecution` | Deny `cat .env`, secret patterns in commands (`failClosed: true`) |
| `preToolUse` | Deny Read on sensitive paths; redact Write content via `updated_input` |
| `beforeMCPExecution` | Local + cloud enforce; deny unproxied MCP with secrets (`failClosed: true`) |
| `afterShellExecution` | Metadata audit if command output contains secret patterns |
| `sessionStart` | Inject workspace token env + agent context |

Hooks must use **shell wrapper paths** (`.cursor/hooks/blekline-*.sh`), not bare `node` + `args`.

## Enterprise preset

`.blekline/cursor.json`:

```json
{
  "enterprisePreset": true,
  "promptPolicy": "auto_mask",
  "shellGuard": true,
  "toolGuard": true,
  "mcpGuard": true,
  "shellGuardMode": "local",
  "failClosed": true,
  "copyMaskedToClipboard": true,
  "emitAuditEvents": true,
  "showMaskedInUi": false
}
```

`enterprisePreset: true` enables all guards and `failClosed` on security hooks.

## Chat send flow (IDE)

1. User sends secrets → **blocked** (never hits model)
2. Short notice + trace ID; masked text on **clipboard** (default)
3. **Cmd+V + Enter** → passthrough allows safe version
4. Metadata events → workspace Activity (`cursor_prompt_governance`)

Silent auto-send in native Cursor chat is **not** available — Cursor's hook schema does not allow in-place prompt rewrite.

## Residual gaps (honest)

- **Cloud Agents:** no `beforeSubmitPrompt` or `beforeMCPExecution` — use ingress for production
- **Tab completions:** not covered by current hooks
- **User disables hooks:** requires Cursor Enterprise team hooks / MDM
- **Native Cursor model HTTP:** not wrapped — only hook + MCP paths

## Platform notes

| OS | Support |
|----|---------|
| macOS | Full (tested) |
| Linux | Full (`.sh` hooks) |
| Windows | Use Git Bash/WSL for `.sh` hooks; native `.cmd` wrappers on roadmap |

## Token scopes

Workspace token needs `mask:write` and `events:write`. Use a **dedicated eval workspace** per customer — not shared sample tenants.

## 10-step verification

1. MCP green: `blekline` + `blekline-proxy`
2. Hooks: 7 `.cursor/hooks/blekline-*.sh` entries (not bare `node`)
3. Chat block: secrets in Send → blocked + clipboard
4. Chat passthrough: Cmd+V + Enter → allowed
5. MCP: `blekline_mask_prompt` → masked JSON
6. Proxy: write with secrets → block/mask
7. Read deny: agent Read `.env` → denied
8. Shell deny: `cat .env` → denied
9. Write redact: Write with API key → redacted args
10. Activity: metadata only; trace ID from block notice

```bash
pnpm build:packages
pnpm generate:mcp-configs --local
pnpm demo:cursor-hook-smoke
pnpm demo:mcp-smoke
```

---

**Next:** [Trust boundaries](/docs/security/trust-boundaries) · [Cursor MCP setup](/docs/mcp/cursor) · [Ingress proxy](/docs/api/ingress-proxy)