Cursor is no longer “VS Code with autocomplete.” It is an agent runtime with a CLI, cloud agents, hooks, and a PR reviewer. Here is how a DevOps or security engineer actually gets work out of it without burning credits or trust.
See the workflow in action, tap through the tabs below:
// install the desktop app, then the CLI
# macOS / Linux / WSL curl https://cursor.com/install -fsS | bash agent --version # Windows (PowerShell) irm 'https://cursor.com/install?win32=true' | iex
// .cursor/rules/infra.mdc
--- description: Infra safety rails for this repo globs: ["terraform/**", "k8s/**", ".github/workflows/**"] alwaysApply: false --- - Never run terraform apply, kubectl apply, or helm upgrade. Plan or diff only. - Every change to a security group or NetworkPolicy needs a one-line "why" comment. - Prefer variables over hard-coded CIDRs, ARNs, or account IDs. - If a secret would be needed, stop and ask. Never write a placeholder secret.
// non-interactive run from CI or a cron box
agent -p "Audit terraform/ for security groups that allow 0.0.0.0/0 on ports 22 or 3389. Output a markdown table: file, resource, port, severity. Do not edit files." \ --output-format text > audit-$(date +%F).md
// .cursor/hooks.json blocks destructive shell commands
{
"version": 1,
"hooks": {
"beforeShellExecution": [
{ "command": "./scripts/guard.sh" }
]
}
}
# scripts/guard.sh reads the JSON on stdin, greps the command
# for "apply|destroy|rm -rf|--force", and exits 2 to block.
Auto-review is not a security boundary. Cursor’s own docs say so. The default Run Mode uses a classifier plus a sandbox, but a hook that exits 2 is the only hard block you control.
Edits hit disk immediately. The Agent does not stage a preview. Work on a branch, commit often, and review the diff before you push.
.cursorignore is not a secrets vault. It hides files from Agent, Tab, and @-mentions, but not from terminal commands or MCP tools. Keep real secrets out of the repo entirely.
What Cursor is in 2026 (and what it is not)
Cursor started life as a VS Code fork with a smarter autocomplete. That description is now about three product generations stale. Today it is an agent platform that happens to ship an editor: Tab for inline completions, Agent as the main chat-and-edit surface with Plan, Ask, and Debug modes, Cloud Agents (formerly Background Agents) that run in isolated VMs and can be kicked off from Slack, GitHub, or your phone, a headless CLI called agent, a hooks system, and Bugbot, a pull request reviewer that lives on GitHub.
What it is not: a substitute for judgment about production. The defaults lean toward speed; this tutorial tilts them back toward safety without losing it.
Quick setup
Download the desktop app from cursor.com/downloads (macOS 12+, Windows 10+, Linux via apt, yum, or AppImage). Open a repo, press Cmd+I (or Ctrl+I on Windows and Linux) to open the Agent panel. Cmd+K is Inline Edit, Shift+Tab rotates between Agent, Plan, Ask, and Debug modes, and Cmd+/ cycles models.
Then install the CLI, because half the workflows below run outside the editor:
# macOS / Linux / WSL curl https://cursor.com/install -fsS | bash agent --version # Windows PowerShell irm 'https://cursor.com/install?win32=true' | iex
Add ~/.local/bin to your PATH if agent is not found, and run agent update periodically. Finally, open Settings with Cmd+Shift+J and confirm Privacy Mode is on. It is the default on paid plans and it guarantees your code is not used for training by Cursor or the model providers.
The principle: constrain first, then delegate
The classic mistake is opening the Agent and typing "fix the deploy." It will try. It will also run commands, edit six files, and save every edit to disk before you have read any of it. That is a missing-guardrails problem, not an AI problem.
So reverse it. Write down what the agent may never do (rules), wire a hard block for the commands that would page you at 3AM (hooks), and only then delegate bigger tasks. If you have read our Claude Skills playbook post, this is the same idea wearing a different jacket: encode the tribal knowledge once, reuse it forever.
7 workflows that earn their credits
1. Write the rules file before the first prompt
Cursor reads a root AGENTS.md automatically, plus any .cursor/rules/*.mdc file whose globs match the files in play. Plain .md files there are ignored, so mind the extension. Type /create-rule to scaffold one. The Rules tab in the widget above is a real starting point for an infra repo. Rules affect the Agent only, not Tab or Inline Edit.
2. Plan mode for anything touching prod
Switch to Plan with Shift+Tab and give it the task. Plan mode reads the repo and produces a file-by-file scope before touching anything. Example prompt:
Plan a change that moves our bastion SSH ingress from 0.0.0.0/0 to a variable called admin_cidrs with a validation block. List every file you will touch, every module that references them, and what could break in staging.
Read the plan like a change request. An unexpected file in the list is the moment to ask why, not after the edit.
3. Headless audits from the CLI
The agent -p flag runs a single non-interactive prompt and prints the result, which makes Cursor a scriptable auditor. Drop this in a nightly job on a jump box or a CI runner:
agent -p "List every GitHub Actions workflow in .github/ that uses a third-party action pinned to a tag instead of a commit SHA. Table: file, action, line. Do not edit anything." --output-format text > actions-pins.md
With edit-forbidding rules, that is a read-only scanner that understands context, not just regex. Prefix a CLI prompt with & to hand it to a Cloud Agent instead.
4. Hooks as the hard stop
Rules are suggestions to a model. Hooks are code. A .cursor/hooks.json (or ~/.cursor/hooks.json for every project) can register scripts for beforeShellExecution, afterFileEdit, beforeMCPExecution, and more. Your script gets JSON on stdin; exit code 2 blocks the action. A ten-line grep for apply, destroy, rm -rf, or --force is the highest-leverage thing in this article.
5. Debug mode for the flaky pipeline
Debug mode instruments your app with runtime logging and reasons over what it sees instead of guessing from static code:
Our deploy/healthcheck.py intermittently reports the service down for ~2s after a rolling restart. Instrument it, reproduce with the local compose stack, and tell me whether it is a readiness gate or DNS caching before you change anything.
6. Parallel worktrees for the boring migrations
Type /worktree in the Agent and Cursor creates an isolated git worktree so multiple agents can run without stepping on each other. /best-of-n runs the same task several ways and lets you pick the winner. Perfect for "bump every Helm chart to the new ingress API" chores: fire three attempts, merge the cleanest.
7. Bugbot on every infra PR
Bugbot reviews pull requests on GitHub and leaves inline comments. It has its own rules file, .cursor/BUGBOT.md, and ignores your .mdc rules, so restate the infra invariants there. Set effort to High on repos that gate production. Its findings seed the next Agent prompt, which closes the loop.
Safety and gotchas
Run Modes are not a security boundary. The old "YOLO mode" and "Ask Every Time" are gone. Settings, Agents, Approvals & Execution now offers Auto-review (default, classifier plus sandbox), Allowlist, and Run Everything. Cursor's docs say plainly that Auto-review is not a security boundary. Cloud Agents never prompt for approval at all. Hooks are your boundary.
Three more bites. Agent edits save to disk immediately, so branch first and read the diff before you push. .cursorignore hides files from Agent, Tab, and @-mentions but not from terminal commands or MCP tools, so it is no place to hide a .env. And MCP servers in .cursor/mcp.json run with your credentials; treat a project-level MCP config in a repo you did not write like an unknown shell script. More on that risk in our post on MCP connectors for DevOps and security.
Usage and cost tips
Cursor's tiers are Hobby (free, limited Agent requests), Pro at $20 a month, Pro+ at $60, Ultra at $200, Teams at $40 per user, and Enterprise on custom terms. Every paid plan includes a monthly pool of model usage split between Cursor's own models (Composer and Grok variants, generous limits) and third-party frontier models billed at API rates. Blow through the pool and you roll into on-demand billing at the same rates, never a quality downgrade.
Model choice is the whole bill. Use Composer for planning, refactors, and audits; save the top frontier model for the one gnarly diagnosis a day. Cursor's own docs estimate a daily Agent user lands around 60 to 100 dollars a month all in, and most of that delta is people running the most expensive model for tasks that did not need it.
Set a spend limit the first time you launch a Cloud Agent. Metered billing plus an autonomous loop is how surprise invoices happen.
FAQ
Is Cursor safe to use on production infrastructure repos?
Yes, if you treat it like a junior engineer with root: rules, a hook that blocks apply and destroy, Privacy Mode on, every diff reviewed on a branch. Skip those and you are trusting a classifier the vendor says is not a security boundary.
Cursor CLI vs Claude Code vs Gemini CLI: which one for DevOps?
They overlap heavily. Cursor's edge is editor integration, worktree parallelism, and Bugbot on GitHub. If your team lives in the Cursor editor, the CLI inherits the same rules and hooks. For a model-agnostic terminal agent, see our Gemini CLI tutorial.
Does Cursor train on my code?
Not when Privacy Mode is on, which is the default on paid plans and can be enforced org-wide on Teams and Enterprise. Cursor states that neither it nor its model providers use Privacy Mode traffic for training.
Start with the hook
If you do one thing from this post, ship the beforeShellExecution guard today. Ten minutes turns Cursor from a fast tool you have to watch into one you can trust with real work. Then the rules file, then the audit. Want the structured version with hands-on labs on agent guardrails? Check out our courses.
