Cursor

Cursor is a full editor built around agentic editing, which means the agent is not a panel beside the work — it is the primary way the work happens. Multi-file edits, terminal commands and codebase-wide reasoning are the default interaction, so the volume of agent-initiated action per engineer is high and the friction per action is deliberately low.

Behaviour is shaped by rules. Project rules live in the repository, user rules live with the individual, and Cursor also reads the cross-tool `AGENTS.md` convention. Rules are the highest-leverage governance artifact on this surface and the least-governed in practice: a rules file is prose, it arrives through an ordinary pull request, and a reviewer skims it. An instruction that quietly relaxes a safeguard reads exactly like an instruction that improves code style.

MCP support is first-class, and per-project server configuration means connectors are added at the pace of individual convenience. The same servers appear across the company's other AI surfaces, governed separately in each. Team and enterprise plans provide admin controls and a privacy mode governing code retention, and configuring those is the baseline — but they address data handling rather than artifact trust.

The structural point for a security team is that Cursor concentrates a lot of agent capability inside a tool engineers experience as their editor. Anything that feels like editor configuration — a rules file, an MCP entry, an extension — is in fact agent policy, and it is edited with the ceremony of a preferences pane.