What can you do with this server?

This server lets MCP hosts (e.g., Claude Code, Claude Desktop) delegate code tasks to the Cursor Agent CLI, keeping context small and token costs low. Core Tools * Chat (cursor_agent_chat): One-shot Q&A or instructions, with optional model and bare_config mode. * Edit files (cursor_agent_edit_file): Apply prompt-based edits, with dry-run and apply options. * Analyze files (cursor_agent_analyze_files): Inspect file(s)/directories with custom prompt. * Search repo (cursor_agent_search_repo): Search code using query and include/exclude globs. * Plan tasks (cursor_agent_plan_task): Generate a numbered plan for a goal with constraints. * Raw CLI (cursor_agent_raw): Pass raw argv for advanced use cases. * Async jobs: cursor_agent_start launches long tasks in background; cursor_agent_check polls status/output; cursor_agent_cancel kills them. * Legacy (cursor_agent_run): Single-shot chat (superseded by chat). Key Features * Output formats: text, json, or markdown. * Model override: Choose model per call (e.g., auto, gpt-5). * bare_config: Fast startup (~15-20s vs ~60-90s) via isolated config directory (requires Cursor API key). * Host-agnostic: Works with any stdio MCP host. * Security: Spawns with shell: false, Zod-validated inputs, redacts API keys in logs. * Flexible configuration: API key, working directory, executable path, extra args via per-call parameters or environment variables.

How do I use Cursor Agent MCP?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Cursor Agent MCP search the codebase for references to the User model" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Cursor Agent MCP

by lipey1

Overview Schema Related Servers Score Discussions

JavaScript

Local

🖱️ Cursor Agent MCP

A fast, hardened Model Context Protocol server that lets any MCP host (Claude Code, Claude Desktop, and others) drive the Cursor Agent CLI.

Offload heavy, repo‑aware "thinking" — search, analysis, planning, edits — from your host model to cursor-agent, keeping the host's context small and your token bill low.

Node MCP License: MIT Status

Why this exists

Large hosts like Claude Code burn tokens when they read big codebases directly. This server exposes a set of focused, verb-centric tools (chat, edit, analyze, search, plan, raw) that delegate the heavy lifting to the Cursor Agent CLI with tight scopes and concise outputs — so the host stays cheap and fast.

It also fixes a very real papercut: on Linux, cursor-agent -p can take 60–90 seconds just to start because it loads your desktop's MCP servers and syncs marketplace plugins before answering. This server ships a bare_config mode that runs the CLI against an isolated config directory, cutting cold starts to ~15 seconds — without touching your real ~/.cursor setup.

flowchart LR
    A[Claude / MCP host] -- stdio --> B[Cursor Agent MCP]
    B -- spawn --> C[cursor-agent CLI]
    C -- isolated CURSOR_CONFIG_DIR --> D[(no user MCPs/plugins<br/>fast startup)]
    C --> E[Model: auto / gpt-5 / composer-2]

Related MCP server: GPT Commander

Highlights

⚡ bare_config fast mode — isolated CURSOR_CONFIG_DIR skips user MCPs/plugins (~90s → ~15s on Linux).
🧰 10 tools — chat, edit, analyze, search, plan, raw, legacy run, plus async start/check/cancel for long jobs.
🔑 First-class auth & model — pass api_key and model per call or via env; API keys are redacted in debug logs.
🧵 Async jobs — fire long tasks in the background and poll them without hitting tool-call timeouts.
🛡️ Hardened spawning — shell: false (no injection), Zod-validated inputs, robust timeouts and optional idle-kill.
🔌 Host-agnostic — works with Claude Code, Claude Desktop, or any stdio MCP client.

Requirements

Node.js 18+ (tested through Node 22)
Cursor Agent CLI on your PATH as agent or cursor-agent (or point to it with CURSOR_AGENT_PATH)
A Cursor API key (crsr_…) if you use bare_config (an isolated config can't reuse the desktop login)

# verify the CLI is available
agent --version

Install the CLI from the Cursor CLI docs if it's missing.

Installation

git clone https://github.com/lipey1/cursor-agent-mcp.git
cd cursor-agent-mcp
npm install        # or: npm ci

Run it directly (stdio):

node ./server.js

Most of the time you won't run it by hand — your MCP host launches it for you (see below).

Configure your MCP host

Add an entry pointing at server.js. Recommended fast defaults:

{
  "mcpServers": {
    "cursor-agent": {
      "command": "node",
      "args": ["/absolute/path/to/cursor-agent-mcp/server.js"],
      "env": {
        "CURSOR_AGENT_PATH": "/home/you/.local/bin/agent",
        "CURSOR_API_KEY": "crsr_your_key_here",
        "CURSOR_AGENT_MODEL": "auto",
        "CURSOR_AGENT_FORCE": "1",
        "CURSOR_AGENT_TRUST": "1",
        "CURSOR_AGENT_BARE_CONFIG": "1",
        "CURSOR_AGENT_TIMEOUT_MS": "0",
        "CURSOR_AGENT_ASYNC_MAX_MS": "0"
      }
    }
  }
}

Never commit your real key. Put it in the host's MCP env (or your shell environment), not in a tracked file.

Claude Code: add the block to your project's .mcp.json.
Claude Desktop: add it under mcpServers in claude_desktop_config.json.

The `bare_config` fast path

On Linux, the Cursor Agent CLI loads ~/.cursor/mcp.json and syncs marketplace plugins (Prisma, Figma, Notion, …) before it answers — often 60–90 seconds of pure startup, even for a one-line question.

Setting CURSOR_AGENT_BARE_CONFIG=1 (or bare_config: true per call) points the CLI at an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default). It skips your desktop MCPs and plugins entirely.

Configuration	Cold start	Notes
Default (loads `~/.cursor`)	~60–90s	Your real desktop MCPs + marketplace plugins
`bare_config: true`	~15–20s	Isolated config; your `~/.cursor` is untouched
+ telemetry disabled (default)	~15–20s	Child gets `OTEL_SDK_DISABLED=true` (set `CURSOR_AGENT_KEEP_TELEMETRY=1` to opt back in)

OpenTelemetry fan-out alone can add ~15–50s per call (CDN contacts on every spawn). This server disables it in the child process by default.

Because the isolated config has no saved login, provide an API key when using this mode.

Tools

All tools share a COMMON set of arguments:

Arg	Type	Description
`output_format`	`"text" \| "json" \| "markdown"`	Response format (default `text`)
`model`	`string`	CLI model id (`auto`, `gpt-5`, `composer-2`, …); overrides `CURSOR_AGENT_MODEL`
`api_key`	`string`	Cursor API key; prefer setting it via env
`force`	`boolean`	Pass `--force` (run shell without prompts)
`trust`	`boolean`	Pass `--trust` (default `true`)
`bare_config`	`boolean`	Use the isolated fast config
`config_dir`	`string`	Explicit `CURSOR_CONFIG_DIR` override
`cwd`	`string`	Working directory for the CLI
`executable`	`string`	Explicit path to the CLI binary
`extra_args`	`string[]`	Extra argv passed through
`echo_prompt`	`boolean`	Prepend the effective prompt to the result

Tool	Purpose
`cursor_agent_chat`	One-shot chat with a prompt
`cursor_agent_edit_file`	Prompt-based file edit (diff or apply)
`cursor_agent_analyze_files`	Analyze one or more paths
`cursor_agent_search_repo`	Code search with include/exclude globs
`cursor_agent_plan_task`	Produce a numbered plan for a goal
`cursor_agent_raw`	Escape hatch: pass raw argv to the CLI
`cursor_agent_run`	Legacy single-shot chat (kept for compatibility)
`cursor_agent_start`	Start a long task in the background → `job_id`
`cursor_agent_check`	Poll a background `job_id`
`cursor_agent_cancel`	Kill a background job

Examples

Chat (fast mode, explicit model):

{
  "name": "cursor_agent_chat",
  "arguments": {
    "prompt": "Who created React?",
    "model": "auto",
    "bare_config": true
  }
}

Scoped code search:

{
  "name": "cursor_agent_search_repo",
  "arguments": {
    "query": "fetch(",
    "include": ["src/**/*.ts", "app/**/*.tsx"],
    "exclude": ["node_modules/**", "dist/**"],
    "output_format": "markdown"
  }
}

Long task without timeouts:

// 1) start
{ "name": "cursor_agent_start", "arguments": { "prompt": "Refactor the auth module and add tests", "label": "auth-refactor" } }
// → returns { "job_id": "job_1_..." }

// 2) poll until status is completed/failed
{ "name": "cursor_agent_check", "arguments": { "job_id": "job_1_...", "full": true } }

Environment variables

Variable	Meaning
`CURSOR_AGENT_PATH`	Absolute path to `agent` / `cursor-agent` (default: `agent` on PATH)
`CURSOR_API_KEY` / `CURSOR_AGENT_API_KEY`	API key passed as `--api-key` and into the child env
`CURSOR_AGENT_MODEL`	Default model (`--model`)
`CURSOR_AGENT_FORCE`	`"1"`/`"true"` → inject `--force`
`CURSOR_AGENT_TRUST`	`"1"`/`"true"` → inject `--trust` (default true)
`CURSOR_AGENT_BARE_CONFIG` / `CURSOR_AGENT_FAST`	`"1"` → isolated `CURSOR_CONFIG_DIR`
`CURSOR_AGENT_BARE_CONFIG_DIR`	Where the bare config lives (default `~/.cursor-agent-mcp`)
`CURSOR_AGENT_CONFIG_DIR`	Always use this `CURSOR_CONFIG_DIR` (even without the bare flag)
`CURSOR_AGENT_TIMEOUT_MS`	Hard runtime ceiling per call (default `30000`); `"0"` disables
`CURSOR_AGENT_ASYNC_MAX_MS`	Max lifetime for async jobs (default `1800000`); `"0"` disables
`CURSOR_AGENT_IDLE_EXIT_MS`	Idle-kill threshold; `"0"` disables (recommended)
`CURSOR_AGENT_KEEP_TELEMETRY`	`"1"` → keep CLI OpenTelemetry on; default is off (`OTEL_SDK_DISABLED=true` in the child)
`CURSOR_AGENT_ECHO_PROMPT`	`"1"` → prepend the prompt to the result
`DEBUG_CURSOR_MCP`	`"1"` → stderr diagnostics (API keys redacted)

Quick smoke test

A tiny stdio client is included:

# list tools and call chat
node ./test_client.mjs "Hello from smoke test"

# fast mode + explicit key
CURSOR_AGENT_BARE_CONFIG=1 \
CURSOR_API_KEY="crsr_your_key" \
node ./test_client.mjs "Say only OK"

# call the raw tool with --help (no implicit --print)
TEST_TOOL=cursor_agent_raw TEST_ARGV='["--help"]' node ./test_client.mjs

Troubleshooting

Symptom	Fix
`agent not found`	Set `CURSOR_AGENT_PATH` or add the CLI to `PATH`
~60–90s before the first token	Enable `CURSOR_AGENT_BARE_CONFIG=1` or `bare_config: true`
Auth error / 401	Set `CURSOR_API_KEY` (or `CURSOR_AGENT_API_KEY`), or pass `api_key` per call
Cut off mid-answer	Raise `CURSOR_AGENT_TIMEOUT_MS` or set it to `"0"` to disable; keep `CURSOR_AGENT_IDLE_EXIT_MS=0`
Empty output	Verify the model id and credentials; try `cursor_agent_raw` with `argv: ["--version"]`

Security notes

Child processes are spawned with shell: false — no shell injection or quoting pitfalls.
All tool inputs are validated with Zod.
API keys passed via argv are redacted in debug logs; prefer env over per-call api_key.
bare_config isolates only the CLI's config directory — it never modifies your real ~/.cursor.
.gitignore excludes .env, keys, and the bare config dir so secrets don't get committed.

Manager skill (`/cursor-agent on|off`)

Optional skill so Claude Code / Claude Desktop local Code acts as manager: it briefs Cursor Agent, waits, and only reviews the result. When off, Claude does the work itself.

Not for Cursor IDE (you are already the Cursor Agent there).

The slash command name is the skill folder name → /cursor-agent.

chmod +x skills/cursor-agent/install.sh
./skills/cursor-agent/install.sh

Then open a new Claude Code session (or /reload-skills) and type / → pick cursor-agent.

Examples: /cursor-agent on · /cursor-agent off · /cursor-agent status.

Details: skills/cursor-agent/README.md.

Project layout

cursor-agent-mcp/
├── server.js          # MCP server: tools, spawning, async jobs
├── test_client.mjs    # stdio smoke-test client
├── package.json
├── skills/
│   └── cursor-agent/   # slash command: /cursor-agent
├── misc/              # Host/agent instruction docs (cost-aware usage)
├── LICENSE
└── README.md

Credits

This project builds on the original sailay1996/cursor-agent-mcp. Enhancements in this fork — model/API-key options, bare_config fast startup, --trust handling, async job hardening, and this documentation — by Felipe Estrela.

License

MIT — see the license file for details.

Available Tools

10 tools

cursor_agent_analyze_filesC

Analyze one or more paths; optional prompt.

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`paths`	Yes
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`prompt`	No
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`output_format`	No		text

TDQS

C2.1/5.0

Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and the description (5 words) reveals almost no behavioral traits. Does not mention side effects, permissions, idempotency, or any constraints beyond basic function.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very concise (5 words), but this brevity sacrifices needed information. Adequate for a simple tool, but for 13 parameters, it's under-specified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 13 parameters, no output schema, and no annotations, the description is woefully incomplete. No explanation of return values, behavior, or setup requirements.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema coverage at 46% (low), the description should compensate but only mentions 'paths' and 'optional prompt' without adding details. No parameter documentation beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Analyze one or more paths', which gives a verb and resource, but 'analyze' is vague and doesn't distinguish from sibling tools like search_repo or plan_task. No differentiation provided.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Missing context for appropriate scenarios or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_cancelA

Kill a running job started with cursor_agent_start.

ParametersJSON Schema

Name	Required	Description	Default
`job_id`	Yes

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the tool's destructive nature (Kill) but lacks details on side effects, reversibility, or required permissions. Without annotations, the description carries full burden; it could be more transparent about what happens to the job's resources.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action (Kill) and the target. Every word is necessary, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple kill operation with one parameter and no output schema, the description provides minimal but potentially sufficient context. However, it does not mention the return value or confirmation of success, leaving gaps for an agent to infer behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter (job_id) with no description, and the description does not explain what job_id represents or how to obtain it. With 0% schema coverage, the description should compensate but fails to add any meaning beyond the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Kill) and the resource (a running job started with cursor_agent_start). It distinguishes from sibling tools by explicitly linking to cursor_agent_start, making its role as a cancellation tool unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for killing jobs initiated by cursor_agent_start, providing clear context. However, it does not explicitly state when not to use it or mention alternatives (e.g., cursor_agent_check for status), leaving some ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_chatC

Chat with Cursor Agent. Supports model, api_key, and bare_config (fast isolated config).

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`prompt`	Yes
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`output_format`	No		text

TDQS

C2.8/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It mentions support for model, api_key, and bare_config, but does not detail return behavior, side effects, or authentication requirements. The phrase 'fast isolated config' for bare_config is a minor positive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise (one sentence), but it lacks necessary detail. It earns its place but is under-specified for a 12-parameter tool. Conciseness is positive, but not at the expense of completeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 12 parameters, no output schema, and no annotations, the description is insufficient. It does not explain return values, error conditions, or expected behavior. The tool's complexity demands more context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%. The description highlights three key parameters (model, api_key, bare_config), adding emphasis beyond the schema. However, it does not explain other parameters or their interdependencies, leaving gaps for undocumented fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Chat with Cursor Agent.' It uses a specific verb-resource pair and mentions supported parameters. However, it does not differentiate from siblings like cursor_agent_raw or cursor_agent_start, which also involve interaction with the agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description does not mention context, prerequisites, or exclusions, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_checkB

Poll status/output of a job from cursor_agent_start.

ParametersJSON Schema

Name	Required	Description	Default
`full`	No
`job_id`	Yes

TDQS

B3.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It states 'poll status/output', which suggests a read operation, but does not disclose whether the tool is blocking, can be called multiple times, or any other behavioral traits like rate limits or pagination.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently communicates the tool's purpose with zero wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description does not specify the format or fields of the status/output. It is adequate for a simple poll but incomplete for an agent to understand response structure or termination conditions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds no meaning beyond the schema. It does not explain what job_id refers to or what the 'full' boolean parameter does. The agent must infer from the tool name and context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool polls status/output of a job from cursor_agent_start, using specific verb and resource, and it distinguishes from sibling tools like cursor_agent_start (which starts jobs) and cursor_agent_cancel (which cancels).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage after starting a job with cursor_agent_start, but it does not explicitly state when to use this tool versus alternatives or provide any when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_edit_fileC

Edit a file with an instruction (prompt-based wrapper).

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`file`	Yes
`apply`	No
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`prompt`	No
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`dry_run`	No
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`instruction`	Yes
`output_format`	No		text

TDQS

C2.4/5.0

Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description does not disclose any behavioral aspects such as side effects, permissions required, or destructiveness. 'Edit' implies mutation but no further transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is concise, but at the cost of under-specification. Could be more informative while remaining brief.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 16 parameters, 38% schema coverage, no output schema, and many sibling tools, the description is extremely insufficient. Lacks details on edit behavior, output, and differentiation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 38%. Description adds no meaning beyond what is in the schema. Does not explain how parameters interact or typical usage patterns.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'edit', the resource 'file', and the mechanism 'with an instruction (prompt-based wrapper)'. Distinguishes from sibling tools like cursor_agent_chat or cursor_agent_search_repo which do not edit files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs siblings (e.g., cursor_agent_raw or cursor_agent_chat). No prerequisites, exclusions, or context for appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_plan_taskC

Generate a plan for a goal with optional constraints.

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`goal`	Yes
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`constraints`	No
`echo_prompt`	No
`output_format`	No		text

TDQS

C2.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only states the tool generates a plan but does not mention side effects, authentication needs, rate limits, or whether it is a long-running operation. This is insufficient for an agent to understand behavioral implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise at one sentence, with no fluff. However, it lacks structure such as sections or examples that could improve readability. It is appropriately sized but could be more informative without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 13 parameters, 1 required, and no output schema, the description is too minimal. It does not explain what the generated plan contains, how it is returned, or how to interpret the output. This leaves significant gaps for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 46% schema description coverage, the description should compensate by explaining key parameters. It only mentions 'optional constraints' for the constraints parameter, adding minimal value beyond the schema. The other 12 parameters are not elaborated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool generates a plan for a goal with optional constraints. The verb 'generate' and resource 'plan for a goal' are specific. Though abstract, it differentiates from sibling tools like cursor_agent_chat or cursor_agent_edit_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, typical scenarios, or exclusions, leaving the agent to infer usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_rawC

Advanced: raw argv after common flags (e.g. ["--help"]). print defaults to false.

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`argv`	Yes
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`print`	No
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`output_format`	No		text

TDQS

C2.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must fully disclose behavior. It only mentions that 'print defaults to false' and gives an example of argv. There is no information about side effects, return values, or what happens with the provided arguments.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (one sentence), but it sacrifices clarity and completeness. While brevity is good, critical information is missing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 parameters, no output schema, no annotations), the description is grossly incomplete. It does not explain how to construct the argv, what the tool outputs, or handle errors. This is inadequate for effective tool selection and use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 46%, meaning the schema describes 6 of 13 parameters. The description adds almost no value beyond the schema, only noting that 'print defaults to false'. For a tool with many parameters, this is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it's an 'Advanced' tool for passing raw argv after common flags, and mentions a default for 'print'. However, it does not clearly differentiate from sibling tools like cursor_agent_chat or cursor_agent_run, leaving ambiguity about its specific purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description lacks any context about appropriate use cases, prerequisites, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_runC

Legacy single-shot chat (prompt as positional). Prefer cursor_agent_chat.

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`prompt`	Yes
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`output_format`	No		text

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It only labels as 'legacy' and 'single-shot chat', with no details on side effects, permissions, or call behavior. This is insufficient for a tool with 12 parameters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is very short (two sentences), which is concise but may be under-specified given the tool's complexity. It front-loads the key information (legacy, prefer alternative) but lacks structure for the many parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 12 parameters, no annotations, no output schema, and high complexity, the description is severely incomplete. It does not cover return values, error conditions, or behavior beyond being a 'single-shot chat'. Agent cannot fully understand the tool's capabilities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%, meaning half of parameters have descriptions. The description adds no parameter info beyond the schema, failing to compensate for the undocumented parameters. Agent gets no additional meaning from the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it is a 'legacy single-shot chat' with positional prompt, distinguishing it from sibling cursor_agent_chat. The verb 'chat' and resource specification are clear, though it could be more explicit about the exact function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly directs preference to cursor_agent_chat, providing clear guidance on when not to use this tool. Lacks explicit context on when this legacy tool should still be used.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_search_repoC

Search repository code with include/exclude patterns.

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`query`	Yes
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`exclude`	No
`include`	No
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`output_format`	No		text

TDQS

C2.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and description only states a basic search function. No mention of side effects, permissions, read-only nature, or output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise (one sentence), but too minimal given the complexity. Could benefit from a structured overview of key parameters and usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, 14 parameters, and no behavioral details. The description fails to provide adequate context for an AI agent to safely and effectively invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 14 parameters and 43% schema description coverage, the tool description adds little beyond mentioning include/exclude patterns. Many parameters have inline descriptions, but the overall description does not compensate for the gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool searches repository code and mentions include/exclude patterns. It distinguishes from sibling tools like chat or edit, but no explicit differentiation is provided.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives such as cursor_agent_chat or cursor_agent_raw. Lacks context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cursor_agent_startA

Start a long-running prompt in the background; returns job_id immediately. Poll with cursor_agent_check.

ParametersJSON Schema

Name	Required	Description	Default
`cwd`	No
`force`	No	Pass --force / --yolo so the agent can run shell without prompts. Env: CURSOR_AGENT_FORCE.
`label`	No
`model`	No	Model id for the CLI (e.g. auto, gpt-5, composer-2). Overrides CURSOR_AGENT_MODEL.
`trust`	No	Pass --trust (default true). Env: CURSOR_AGENT_TRUST.
`prompt`	Yes
`api_key`	No	Cursor API key (crsr_…). Prefer CURSOR_API_KEY / CURSOR_AGENT_API_KEY in MCP env.
`config_dir`	No	Explicit CURSOR_CONFIG_DIR override. Implies isolated config for this call.
`executable`	No
`extra_args`	No
`bare_config`	No	Use an isolated CURSOR_CONFIG_DIR (~/.cursor-agent-mcp by default) so the CLI does not load user MCPs/plugins. Much faster startup. Env: CURSOR_AGENT_BARE_CONFIG=1.
`echo_prompt`	No
`output_format`	No		text

TDQS

A3.6/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full burden. It discloses async behavior and polling, but lacks details on side effects, authentication needs, or rate limits. Adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the purpose and immediate follow-up action. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 13 parameters and no output schema, the description is minimal. It explains the basic flow but omits usage patterns and return value details beyond 'returns job_id immediately'. Adequate but could be more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 46%, and the tool description adds no information about parameters. The description does not compensate for the uncovered parameters, leaving gaps despite the schema itself having some descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Start', the resource 'long-running prompt', and the key behavior: background execution with immediate job_id return. It also references a sibling tool for polling, differentiating itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions polling with cursor_agent_check, implying asynchronous use, but does not explicitly state when to use this tool versus other siblings like cursor_agent_run or cursor_agent_chat. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

10 tool updatesv1.2.0Jul 29, 2026
- First observedcursor_agent_analyze_files
- First observedcursor_agent_cancel
- First observedcursor_agent_chat
- First observedcursor_agent_check
- First observedcursor_agent_edit_file
- First observedcursor_agent_plan_task
- First observedcursor_agent_raw
- First observedcursor_agent_run
- First observedcursor_agent_search_repo
- First observedcursor_agent_start

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3/5.0

Disambiguation4/5

Most tools have distinct purposes (chat, edit, analyze, search, plan, raw, async start/check/cancel). However, cursor_agent_chat and cursor_agent_run both perform chat, though the latter is marked as legacy, causing potential confusion.

Naming Consistency4/5

All tools share the 'cursor_agent_' prefix and use snake_case. Most follow a verb_noun pattern (e.g., chat, edit_file, analyze_files, search_repo, plan_task), but 'raw' and 'run' are verb-only, which is a minor inconsistency.

Tool Count5/5

With 10 tools, the set is well-scoped for the domain of interacting with a Cursor agent. It covers common operations without being too sparse or overwhelming.

Completeness4/5

The tool set covers core interactions (chat, file editing, code search, analysis, planning, async jobs, raw access). There are no obvious dead ends, though some advanced IDE operations might be missing, but they are not central to the agent's purpose.

Maintenance

ActivityMaintained

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

mcp-serverOAuth
com.niftypm
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Project Management Communication File Systems
2
saagarpatel.dev Portfolio A
io.github.saagpatel
Agent-native MCP server over the public saagarpatel.dev corpus. Read-only, stateless.
Search Documentation Access
82
supportsheep
io.github.pooriaarab
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Customer Support Content Management Systems Marketing
1
Remote MCP A
com.remote-mcp.mcp
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
Developer Tools Search Agent Orchestration
13

Related MCP Servers

cursor-mcp-server
Coding Agents Command Line
bbarney7
F
license
Not graded
quality
D
maintenance
An MCP server wrapping the Cursor CLI agent, enabling Claude Code and other MCP clients to delegate tasks to Cursor's AI agent for file writing, bash commands, and codebase queries.
Updated 8 months ago (2026-01-20 14:53 UTC)
-
GPT Commander
File Systems Shell Access Developer Tools
PushPullCommitPush
F
license
C
quality
C
maintenance
A security-first MCP server that provides LLMs with structured tools for filesystem, process, search, build/test/lint, IDE integration, and more.
Updated 8 months ago (2026-01-11 08:47 UTC)
40
2
-
cursor-mcp-bridge
Agent Orchestration Coding Agents Autonomous Agents
JaimeJunr
A
license
A
quality
B
maintenance
MCP server that lets any agent or MCP host delegate tasks to the Cursor CLI agent for fast, headless execution. Supports task delegation, project discovery, file analysis, and follow-up sessions.
Updated 10 days ago (2026-08-27 17:25 UTC)
3
14
2
MIT
AI Knowledge Center MCP
Developer Tools Knowledge & Memory Command Line
AHappyAtlas
A
license
Not graded
quality
A
maintenance
Local-first MCP server that provides project context, verification gates, and structured tools for coding agents to discover knowledge, run diagnostics, and execute allowlisted commands within a repository.
Updated 2 months ago (2026-07-14 16:22 UTC)
35
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/lipey1/cursor-agent-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

🖱️ Cursor Agent MCP

Why this exists

Highlights

Requirements

Installation

Configure your MCP host

The bare_config fast path

Tools

Examples

Environment variables

Quick smoke test

Troubleshooting

Security notes

Manager skill (/cursor-agent on|off)

Project layout

Credits

License

Available Tools

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

The `bare_config` fast path

Manager skill (`/cursor-agent on|off`)