What this is for
Guardway governs Cursor on each developer’s machine, not by routing its traffic through your gateway. This covers both the Cursor app and the Cursor CLI. The Guardway agent works through Cursor’s own hooks and reads Cursor’s settings, and the results show in the console under Endpoint AI Risk, on each machine’s detail.Why Cursor is not routed
Cursor can’t be routed through a Guardway gateway:- Cursor sends its requests through Cursor’s servers, even when you use your own API keys.
- The Override OpenAI Base URL setting is per user. Tab never uses it, and Agent and Auto can ignore it.
- The Cursor CLI’s proxy settings only front Cursor’s own API.
What Guardway covers through Cursor hooks
Wherever Cursor is installed, the agent adds its entries to Cursor’s hook file. Your own hooks in the same file are left as they are, and the entries are removed when the agent is uninstalled.Cursor posture
The Cursor posture card on a machine’s detail shows how Cursor is set up there. It is read from Cursor on the machine. Guardway never changes these settings.- IDE run mode: Ask every time, Allowlist, Auto-review or Run everything. A warning shows when Cursor runs agent commands without asking.
- Privacy mode: the privacy mode Cursor is set to.
- Team: locked to your team by device policy, signed in to a team but not locked, or no team.
- Own API keys: which providers have a key in use, and which have a key saved but not in use.
- Unapproved endpoint: flagged when Cursor Chat sends to an endpoint that is not your gateway or an approved host. When no approved list is known, the card shows a neutral custom endpoint note instead.
- Team settings: own API keys disabled by your Cursor team, and the models your Cursor team allows and blocks.
- permissions.json: what the file allows, shown read only. Guardway never writes this file.
- CLI sessions: Cursor CLI sessions running at the last scan, including those started with
--force, which run every command without asking.
Prompt previews
Prompt previews are off by default. Turn on Keep Cursor prompt previews in the policy’s Telemetry section to keep the first 240 bytes of each prompt typed in Cursor, redacted on the machine. It needs Send Claude Code and Cursor usage to Guardway on. Claude Code prompts are never sent.Limits
- The Cursor CLI sends no token usage, subagent or prompt hooks. Its sessions show, but its usage is missing from cost, not zero.
- Cloud agents run on Cursor’s servers, so the agent on the machine does not see them.
- Cost is an estimate at list prices. Cursor bills some usage from plan allowances.
- Model limits are set in Cursor’s own admin settings. Guardway shows them; it does not set them.