---
title: "Govern Cursor"
---

# Govern Cursor

Enforce Neural Inverse Govern agent policy in Cursor with the enterprise hooks file, know what Cursor's hooks do not see, and route custom-model chat through the gateway.

## Control level

| What | Level |
|---|---|
| Shell commands, MCP tool calls and file reads | **Enforced** with the enterprise `hooks.json` in its root-owned location |
| File edits, Cursor's web search and fetch tools | **Not covered**: Cursor has no hook before them |
| Model traffic | **Network, partial**: only chat with a custom model through a custom OpenAI base URL |

The level was verified on 2026-10-15 against Cursor's documented hooks (`hooks.json` version 1, Cursor 2.x) by running Cursor's documented hook input through the real enforcement hook and daemon. Cursor itself is closed source and was not run.

## 1. Write the policy and enrol the machine

Write rules in **Agent policy** ([Agent policy](https://neuralinverse.com/docs/govern/agent-policy/)) and enrol the machine with the endpoint agent ([Deploy](https://neuralinverse.com/docs/deploy/)). The agent fetches the policy compiled for the `cursor` engine and installs `hooks.json` in Cursor's enterprise location:

| OS | Location |
|---|---|
| Linux | `/etc/cursor` |
| macOS | `/Library/Application Support/Cursor` |
| Windows | `C:\ProgramData\Cursor` |

The file registers Govern's enforcement hook on `beforeShellExecution`, `beforeMCPExecution` and `beforeReadFile`, with `failClosed: true`: a crash, timeout or invalid output blocks the action. Hooks from every source run, and a deny outranks every other answer.

## 2. What is not covered

- **File edits.** Cursor has no hook before an edit (`afterFileEdit` only reports it), so `file_write` rules are gaps for Cursor.
- **Cursor's own web search and fetch tools.**
- **`beforeReadFile` in the `cursor-agent` CLI**, which Cursor's forum reports as not implemented.

Shell and MCP hooks can ask the developer; `beforeReadFile` turns an ask into a block. Check the gaps on **Agent policy > Policy preview** with the engine `cursor`.

A `hooks.json` in user or project configuration is not locked, and Cursor runs the action when such a hook script fails. Only the enterprise location gives the Enforced level.

## 3. Route custom-model chat through the gateway

In **Cursor Settings > Models**:

```
OpenAI API Key:            <token printed by keystone-cli token models --tool cursor>
Override OpenAI Base URL:  <your API URL>/api/v1/models/gateway/v1
Custom model:              <model id>
```

1. Run `keystone-cli token models --tool cursor` and copy the token.
2. Enter the values above, add a model you may use and enable only that model for chat.
3. Paste a new token when it expires (at most one hour).

Only chat that uses the custom model reaches the gateway. Cursor sends these requests from its own servers, so the URL must be reachable from the internet, which rules this out for an air-gapped installation. Tab completion and Cursor-hosted models never reach Govern.

## Cursor pages in the console

The **AI tool controls** service (marked beta) has Cursor, Cursor policies, Cursor events and Cursor settings pages for Cursor's own policy evaluation and costs. Policy changes need `controls:manage`. These are a narrowing layer; agent policy is authoritative.

## Audit

Cursor's own audit data can be pulled by a vendor audit connector; see [Evidence](https://neuralinverse.com/docs/evidence/).