Cursor

Cursor is developed by Anysphere. Arrakis governs the full Cursor product line — the IDE, Cursor CLI, Cloud Agents, and Mobile Remote Control — through the vendor’s first-party hook API (cursor.com/docs/hooks) delivered by MDM, complemented by the Cursor admin API for team, seat, and audit metadata. Coverage across the four pillars is scored on the Connectors page.

Primary data planes

• First-party hooks — MDM-delivered. Cursor’s hook API is a Claude-Code-compatible subprocess-over-stdio system covering beforeSubmitPrompt, preToolUse/postToolUse, beforeShellExecution, beforeReadFile, afterFileEdit, beforeMCPExecution, afterAgentResponse, sessionStart/End, and workspaceOpen. This is the only path that captures prompt and tool-call content.
• Admin API — audit-log pull. GET https://api.cursor.com/teams/audit-logs for administrative events (login, seat management, privacy-mode changes, MCP config changes). Metadata only — the docs explicitly state Cursor does not log agent responses or generated code content.

Where telemetry lands

All coding-telemetry paths on this page terminate at the Arrakis coding-telemetry ingest, which runs the shared detection rules (typosquatting, secret exposure, template injection, tool collision, and others). Whether telemetry arrives as native OTLP, a hook-emitted event, or an admin-API pull, it is normalized into the same event registry.

Pages in this section

• Cursor — MDM-delivered hooks, admin API polling, privacy mode enforcement, coverage for CLI / Cloud Agents / Mobile.

Cross-references

• OTel Collector & Arrakis Endpoint
• MDM Sync & Change Management
• Multi-sending OTel
• IdP Integration
• Offboarding
• Quarantine
• Connectors → Coding Agents