agentjail supports Cursor. agentjail install auto-detects Cursor when
~/.cursor/ is present and wires the hook automatically.
Want the OS sandbox and network visibility too? The hook guards tool calls. To also run Cursor inside the kernel sandbox (Seatbelt/Landlock) and capture its LLM traffic, launch it with
agentjail run -- cursor. See the OS-native sandbox.
Install
Quick install (recommended):
curl -fsSL https://agentjail.io/install.sh | sh
The script runs agentjail install, which presents an interactive picker of all
detected agents including Cursor. Press Enter to wire them all.
Wire Cursor specifically:
agentjail install --for cursor
Homebrew:
brew install LuD1161/tap/agentjail
agentjail install --for cursor
Both paths work on macOS and Linux.
What the installer writes
agentjail install --for cursor adds a hook entry to ~/.cursor/hooks.json
on the three blocking events Cursor exposes: beforeShellExecution,
beforeMCPExecution, and beforeReadFile:
{
"version": 1,
"hooks": {
"beforeShellExecution": [
{ "command": "~/.agentjail/bin/agentjail-hook --agent=cursor" }
],
"beforeMCPExecution": [
{ "command": "~/.agentjail/bin/agentjail-hook --agent=cursor" }
],
"beforeReadFile": [
{ "command": "~/.agentjail/bin/agentjail-hook --agent=cursor" }
]
}
}
Every tool call Cursor makes will pass through agentjail-hook before
execution.
Verify it is working
You can test agentjail-hook directly from the terminal (the daemon must be
running). Pipe a synthetic PreToolUse event to the hook and inspect the
output:
echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' \
| agentjail-hook
The hook prints a JSON response:
{
"hookSpecificOutput": {
"hookEventName": "PreToolUse",
"permissionDecision": "deny",
"permissionDecisionReason": "..."
}
}
Exit 0 means allow or ask; exit 2 means deny.
For a full explanation of the hook protocol, see the generic hook guide.