Skip to main content
The NeuralTrust Cursor plugin covers the two risks of agentic coding in Cursor — what the agent is told, and what the agent does. It runs on each developer machine and puts your org’s policy check at each moment: Every decision lands in Activity with consumer_id = cursor:<email>, so you also get a per-developer audit trail; start in Report policy mode to observe before enforcing. The TrustGate MCP half is governance for the tools themselves: instead of developers wiring arbitrary MCP servers, the agent gets one org-curated endpoint whose tool calls still pass through the firewall hooks above.

​
Coverage

Ask — honoured on tool calls, through Cursor’s approval prompt. There is no dialog at the prompt event, so an ask on a prompt is enforced as a block. Use it when your developers work with the Cursor agent and you want its tool calls governed from one org key. Not when you rely on ask stopping a prompt — Cursor has no confirmation dialog at that event and submits with a warning. Limits. No redaction: transform maps to ask by default, so a masking policy degrades to a warning unless transform_action: "deny" is set. The model’s response is never evaluated, and postToolUse cannot revoke a tool that already ran. Tool declarations are not evaluated. Full comparison: Coverage.

​
Two surfaces, two credentials

The plugin (trustguard package) ships both surfaces: Developers do not need NeuralTrust accounts for the firewall path. Do not reuse the tgk_… collector key as an MCP credential.

​
What IT deploys vs what developers install

You do not need to package or push the plugin binary tree via MDM. MDM only needs the managed firewall config file. The plugin’s bootstrap downloads the platform trustguard-cursor binary from GitHub Releases on first use (checksum-pinned).

​
Console setup

  1. Create a Cursor collector (Catalog → IDE & coding agents).
  2. Mint a tgk_… API key on the Auth tab (shown once — store it).
  3. Assign a default policy on the Policies tab.

​
Install the plugin (from GitHub)

The plugin is published as a public GitHub repo. In Cursor, add it the same way you import any GitHub-hosted plugin (Plugins / marketplace → import or add from GitHub): Repository: https://github.com/NeuralTrust/trustguard-cursor-plugin Exact UI labels vary by Cursor version; look for add/import plugin from GitHub or from a git URL and paste that repo.

​
Local clone (optional)

If you prefer a local checkout (e.g. offline pilots):
Or Customize → Plugins → Add → From Local Repo pointing at the clone. make install-local copies into ~/.cursor/plugins/local/trustguard (Cursor rejects out-of-tree symlinks).

​
Managed config (MDM — config only)

Deploy only this file with MDM. Do not distribute the plugin package via MDM unless you have a separate reason to pin a private fork.

​
Managed mode

When the managed file includes api_key:
  • Locked: api_key, data_url, fail_mode — user file and env cannot replace them.
  • Soft prefs may still live in ~/.trustguard/cursor.json: timeout_ms, transform_action, events, consumer_id.

​
Local config only (no MDM)

For pilots without MDM, write ~/.trustguard/cursor.json (chmod 600) with the same JSON shape.

​
TrustGate MCP Gateway (same plugin)

The plugin registers a remote MCP server named TrustGate. Values are Cursor plugin variables (Customize → Plugins → Configure), not cursor.json.
  1. In the console, open an MCP consumer → Connect and copy the endpoint https://{host}/{consumer-slug}/mcp.
  2. Set:
OAuth consumers need only the URL — Cursor runs the login flow on first tool use. Team admins can set variables once for Team Marketplace installs. MCP tool calls still pass through TrustGuard hooks (preToolUse / postToolUse). tool.name is payload.params.name: for Cursor’s mcp__<server>__<tool> that is the last segment. Gate on that short name, not the full hook tool_name. Ask on preToolUse shows Cursor’s permission dialog with A TrustGuard policy needs your approval to continue. (not the gate name).

​
Verify

​
Firewall

  1. Open Cursor and send a test prompt.
  2. Confirm the event in TrustGuard Activity.
  3. consumer_id is typically cursor:<email> when the Cursor account email is present.
Smoke-test the binary (optional):

​
MCP

  1. Confirm TrustGate is enabled under Customize → MCP.
  2. Ask the agent to list or use a tool from a toolkit bound to that consumer.

​
What is evaluated

​
Attributes

  • attributes.collector.type = "ide"
  • attributes.source.application = "cursor-plugin"
  • attributes.cursor.event, workspace, and related fields
  • consumer_id typically cursor:<email>
Gate on source.application and/or tool.name / tool.command. Do not rely on attributes.tool for MCP preToolUse — the name is on the payload.