Observatory › Cursor
Cursor on Windows: what it can do on your computer
Mode it starts in
Starting mode: auto_review
Who decides what would otherwise be asked: another AI model.
Documented as the recommended default since Cursor 3.6; the mode in use is not readable from disk, so this is assumed.
Official source · accessed on 25 October 2026
What it can do by default
According to the vendor's documentation, before you change any setting.
| Action | Where | By default | Note | Source |
|---|---|---|---|---|
| Read files | Working directories | Without asking | Official source | |
| Read files | Credential files it ignores | Denied | Default ignore patterns that cover credential files, for the file tools only. | Official source |
| Read files | The whole system | Without asking | The sandboxed shell's read boundary defaults to the whole system. | Official source |
| Edit files | Working directories | Without asking | Except configuration files. | Official source |
| Edit files | Protected paths | Denied | Official source | |
| Run commands | All commands | Asks first | Official source | |
| Use MCP tools | All MCP tools | Asks first | Official source | |
| Connect to the internet | Any destination | Asks first | With documented exceptions. | Official source |
«Asks first»: the action needs approval. Who gives it depends on the mode it starts in.
Where it keeps configuration and keys
Paths on Windows. <project> is the folder of each project.
| What | Path on Windows | Keys | Note | Source |
|---|---|---|---|---|
| MCP servers (user) | %USERPROFILE%\.cursor\mcp.json | Can hold keys in plain text | MCP env and headers blocks can hold keys. | Source: RosmarOps reading |
| MCP servers (project) | <project>\.cursor\mcp.json | Can hold keys in plain text | Source: RosmarOps reading | |
| Permissions | %USERPROFILE%\.cursor\permissions.json, <project>\.cursor\permissions.json | No keys | Official source | |
| Sandbox | %USERPROFILE%\.cursor\sandbox.json, <project>\.cursor\sandbox.json | No keys | Source: RosmarOps reading | |
| CLI configuration | %USERPROFILE%\.cursor\cli-config.json | Not known | Source: RosmarOps reading | |
| Managed hooks | C:\ProgramData\Cursor\hooks.json | No keys | Source: RosmarOps reading |
What RosmarOps does with this agent
Evaluated since RosmarOps 0.1.0: RosmarOps reads its configuration on your computer, without network access, and gives it an Agent Posture Score.
Security change history
Only changes that affect what it can do on your computer. Nothing is deleted: corrections stay on record.
No security changes recorded yet.
Sources and data
- https://cursor.com/docs/agent/security.md · accessed on 25 October 2026
- https://cursor.com/docs/agent/security/run-modes.md · accessed on 25 October 2026
- https://cursor.com/docs/context/mcp · accessed on 25 October 2026
- https://cursor.com/docs/reference/ignore-file · accessed on 25 October 2026
- https://cursor.com/docs/reference/permissions · accessed on 28 October 2026
- https://cursor.com/docs/reference/sandbox.md · accessed on 25 October 2026
- https://github.com/qtorb/rosmarops/blob/v0.3.0/adapters/windows/cursor.go · accessed on 28 October 2026
- https://github.com/qtorb/rosmarops/blob/v0.3.0/adapters/windows/mcp.go · accessed on 28 October 2026
- This page as JSON
Vendor's reply
None received. If the vendor sends one, it is published here, signed and dated, without changing anything above.
See a factual error? Tell us, with the source: legal@rosmarops.com
Observation of configuration in a controlled environment; not a security guarantee or advice.