← All docs

Cursor

Wire agentjail into Cursor's pre-tool-use hook to enforce policy before every tool call.

agentjail supports Cursor. agentjail install auto-detects Cursor when ~/.cursor/ is present and wires the hook automatically.

Want the OS sandbox and network visibility too? The hook guards tool calls. To also run Cursor inside the kernel sandbox (Seatbelt/Landlock) and capture its LLM traffic, launch it with agentjail run -- cursor. See the OS-native sandbox.

Install

Quick install (recommended):

curl -fsSL https://agentjail.io/install.sh | sh

The script runs agentjail install, which presents an interactive picker of all detected agents including Cursor. Press Enter to wire them all.

Wire Cursor specifically:

agentjail install --for cursor

Homebrew:

brew install LuD1161/tap/agentjail
agentjail install --for cursor

Both paths work on macOS and Linux.

What the installer writes

agentjail install --for cursor adds a hook entry to ~/.cursor/hooks.json on the three blocking events Cursor exposes: beforeShellExecution, beforeMCPExecution, and beforeReadFile:

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      { "command": "~/.agentjail/bin/agentjail-hook --agent=cursor" }
    ],
    "beforeMCPExecution": [
      { "command": "~/.agentjail/bin/agentjail-hook --agent=cursor" }
    ],
    "beforeReadFile": [
      { "command": "~/.agentjail/bin/agentjail-hook --agent=cursor" }
    ]
  }
}

Every tool call Cursor makes will pass through agentjail-hook before execution.

Verify it is working

You can test agentjail-hook directly from the terminal (the daemon must be running). Pipe a synthetic PreToolUse event to the hook and inspect the output:

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' \
  | agentjail-hook

The hook prints a JSON response:

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "deny",
    "permissionDecisionReason": "..."
  }
}

Exit 0 means allow or ask; exit 2 means deny.

For a full explanation of the hook protocol, see the generic hook guide.