Runlayer for Cursor

Connect Cursor to approved MCP servers, sync managed configuration, and add session visibility and runtime controls.

Connect

Give everyone in Cursor the golden path to approved tools

Add one Runlayer Plugin endpoint so people find every tool they’re approved for, or connect a single server when you want a narrower set.

Runlayer Plugin

Unified endpoint

Add one remote MCP endpoint. Users discover and authorize the approved tools available to them without accumulating separate client configurations.

Direct connection

Per-connector endpoint

Give the client a dedicated Runlayer URL for one connector. Identity, policy, scanning, and audit still stay attached to every request.

Connection support

Remote MCP and local MCP

Read the Cursor setup guide

Observe

See how Cursor is being used

Runlayer uses every channel Cursor exposes. Each one is labeled, so you can tell real-time hooks from after-the-fact imports.

Supported

Client hooks

Capture supported prompts, reasoning, local and MCP tool calls, responses, and scanner decisions in real time.

Read the guide

Cursor surfaces

Coverage differs across the classic IDE, Agents Window, CLI, and Cloud Agents.

Surface	Session coverage	Enforcement	Configuration
Classic IDE	supported	supported	endpoint
Agents Window	supported	supported	endpoint. Runlayer currently reports this with classic IDE activity because Cursor does not label the two surfaces separately.
Cursor CLI	degraded	supported	user. Session visibility is partial because Cursor CLI omits some response events. Allow and deny decisions are still enforced.
Cloud Agents	degraded	unsupported	repository or team. Cloud Agents are monitoring-only. Early prompts can arrive before monitoring starts, and cloud runs do not currently report session start or end events.

Enforce

Know exactly what Cursor can block

Each row reflects Runlayer’s enforcement code for Cursor: what it can stop before a call runs, block afterward, or redact in place.

Control	Support	What that means
Pre-tool deny	Supported	Runlayer can deny a tool call before Cursor runs it, including calls to MCP servers.
Post-tool output block	Supported	Runlayer can block a tool’s output before Cursor’s model sees it.
Output rewrite	Unsupported	Cursor cannot take masked output, so Runlayer can block a tool’s output but not mask it.

Enforcement postureManaged device

Minimum supported versionNo minimum listed

Client-specific caveats

Runlayer can block a tool’s output in Cursor but cannot swap in a masked version.
Runlayer cannot tell Agents Window sessions apart from regular IDE sessions.
The Cursor CLI sends fewer session events than the IDE, but Runlayer’s allow and deny decisions still apply.
Cursor Cloud Agents are monitor-only, the first prompt can arrive before Runlayer starts watching, and session start and end are not reported.

Deploy at scale

Roll out Cursor controls with the tools IT already uses

Admins can deploy the Runlayer CLI and endpoint package through MDM, then keep approved MCP configuration in sync automatically.

macOS

SimpleMDM

Open deployment guide →

macOS

Jamf Pro

Open deployment guide →

Windows and macOS

Microsoft Intune

Open deployment guide →

One signed package, settings managed centrally

Runlayer’s endpoint package installs on managed macOS and Windows devices. It discovers shadow AI, keeps hooks in place, captures sessions, and applies runtime controls. Approved MCP configuration re-syncs on a schedule for supported clients.

Plan a rollout

MCP servers