Terminal commands and run modes

Agent can run shell commands, for example installing packages, running tests or calling git, and read their output. It uses your default terminal profile (change it with "Terminal: Select Default Profile" in the Command Palette).

How these calls get approved is set by the run mode, under Cursor Settings > Agents > Approvals & Execution. The same modes govern MCP tool calls and web fetches:

• Auto-review (recommended default): commands on your allowlist run immediately; other shell commands run inside a sandbox (a restricted environment the operating system enforces) when possible; anything that can't be sandboxed is judged by a classifier model on Cursor's servers, which approves it or blocks it and asks you.
• Allowlist: only actions you have allowlisted run without approval; everything else asks you. No classifier.
• Run Everything: every call runs automatically, with no sandbox and no classifier. Only for people who accept the risk, ideally in a disposable environment.

Extra protections can still require approval in automatic modes: blocking automatic file deletion (including rm), blocking edits outside the workspace, and blocking automatic browser use. Turn these on.

When you approve a command yourself, read it fully. Be wary of commands that send data out (curl to unknown hosts), delete or rewrite history (rm -rf, git push --force), touch production (deploy scripts, cloud CLIs) or install unknown packages.

Two notes: Cursor states plainly that Auto-review is not a security boundary; it can misjudge in both directions. And run modes apply to local agents only; Cloud Agents run on their own machines and don't ask for approval.