wb-cursor-bridge
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@wb-cursor-bridgeHave Cursor fix the failing auth tests in my api repo and show the diff"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
wb-cursor-bridge
把 Cursor CLI 包装成一个受治理的 MCP 子代理,让 WorkBuddy(主)调度它执行代码任务。
WorkBuddy 是唯一的控制面(Supervisor),Cursor 是无状态、可替换的执行器(Worker)。
单向控制面 + 双向数据面:Cursor 可以回问取证,但不能反向派活,杜绝控制环路。
用 MCP 承载传输、按 A2A 语义建模(异步任务 + 会话接续 + 产物可追溯),后续换传输层上层零改动。
另起一个 A2A v1.0 HTTP 服务面(
/.well-known/agent.json+ JSON-RPC 2.0),让另一个 agent 能直接发现并调度它。
目标平台:win-x64(同时可在 macOS / Linux 运行)。
一键安装(Windows)
解压
wb-cursor-bridge-v<version>-win-x64.zip(例如wb-cursor-bridge-v0.4.0-win-x64.zip)在解压目录执行:
# 交互式(会提示输入仓库路径)
powershell -ExecutionPolicy Bypass -File install.ps1
# 或一次性给全参数
powershell -ExecutionPolicy Bypass -File install.ps1 `
-WorkspaceRoots "C:\src\api;C:\src\web" `
-MaxConcurrency 4 -TimeoutSec 900安装器会:
步骤 | 行为 |
校验 | 工作区根目录存在;拒绝非法路径 |
运行时 | 复用 PATH 上的 Node 18+;没有则用 |
Cursor | 自动探测 |
配置 | 写入 |
注册 | 同时注册到 WorkBuddy/CodeBuddy( |
自检 | 启动一次 bridge 并输出健康报告 |
常用参数:-BundleNode、-SkipMcp、-Force、-AdminPort 7801、-CursorBin <path>、-NodeVersion v22.12.0、-AdminShutdownToken <token>、-NodeMirror <url>、-NodeOfflinePackage <zip>。
卸载:
powershell -ExecutionPolicy Bypass -File uninstall.ps1 # 保留日志与审计
powershell -ExecutionPolicy Bypass -File uninstall.ps1 -Purge # 一并清除状态为什么 MCP 入口指向
node.exe而不是launcher.cmd:MCP 客户端用child_process.spawn启动 server,而 Node 在不经过 shell 时拒绝执行.cmd/.bat。launcher.cmd保留给人工排障。
Related MCP server: @willpowell8/cursor-cloud-agent-mcp
工具(9 个)
工具 | 用途 |
| 派发任务,立即返回 jobId,永不阻塞 |
| 轮询; |
| 追问;通过 |
| 取消并杀掉整个进程树 |
| 列出近期任务与状态 |
| 查看 |
| 预检:二进制、白名单、状态目录、并发、指标 |
| 成功率 / 耗时 / tier 分布 |
| 取消在途任务、落盘、退出 |
权限分档
tier | Cursor 参数 | 能力 | 隔离 |
|
| 只读问答 | 无 |
|
| 只读规划 | 无 |
|
| 可写 | bridge 托管的 git worktree |
调用方只选档位,永远不传 CLI flag —— 权限策略集中在 bridge,不会被上层 prompt 绕过。
工作原理
WorkBuddy ──MCP(stdio)──▶ wb-cursor-bridge ──spawn──▶ agent -p --output-format stream-json
│ │
├─ 路径白名单 └─ git worktree(execute 档)
├─ 超时 / 并发 / 进程组终止
├─ 事件 JSONL 审计
└─ patch / report 产物落盘execute 任务完成后,bridge 会先把改动导出为 patch 与 report,再删除 worktree —— 你的检出目录始终不被污染。
A2A 互操作(Agent2Agent v1.0)
除了 MCP 控制面,bridge 还能以一个合规的 A2A agent 身份被另一个 agent 发现并对话——
复用同一套 JobManager 引擎,只是把 A2A 请求翻译成引擎调用、把引擎状态翻译成 A2A 响应。
设置 CURSOR_BRIDGE_A2A_PORT 为非 0 即可启用(沿用 adminPort 的"0 = 关闭"约定)。
发现
curl http://127.0.0.1:<a2aPort>/.well-known/agent.json返回遵循 A2A schema 的 Agent Card:protocolVersion、capabilities(streaming /
pushNotifications / stateTransitionHistory)、按 workspace root 派生的 skills[]、
以及启用鉴权时的 securitySchemes / security。
端点与方法
JSON-RPC 2.0 全部
POST /a2a:message/send:派发任务(带message.taskId时续跑既有input-required任务,闭环同一任务 id)tasks/get:支持historyLength取对话历史tasks/cancel:仅submitted/working/input-required可取消,终态返回TASK_NOT_CANCELABLE(-32002)message/stream/tasks/resubscribe:以text/event-stream推送status-update/artifact-update,终态带final
错误码:
TASK_NOT_FOUND(-32001)/INVALID_PARAMS/TASK_NOT_CANCELABLE(-32002)/METHOD_NOT_FOUND(-32601)/UNSUPPORTED_OPERATION(-32004)/AUTH_REQUIRED(-32097)
关键语义约定
A2A 文本在
parts[].text,不在顶层.text;taskId是 Message 的顶层字段(不在 metadata)。 续跑/跟进沿用父任务的contextId;产物以标准Artifact[]暴露,input-required 中断态保留在同一任务 id 上。
推送通知(可选)
在 message/send 的 message.metadata.pushNotification 带上 { "url": "<webhook>", "token": "..." },
任务终态时 bridge 会向该 webhook POST 一个 status-update 事件(含 3 次重试)。
鉴权(可选)
设置 CURSOR_BRIDGE_A2A_AUTH_TOKEN 后,所有 POST /a2a 必须携带 Authorization: Bearer <token>
或 header X-A2A-Token: <token>,否则返回 401 AUTH_REQUIRED(-32097)。Agent Card 端点保持公开。
A2A v1.0 迁移路线(可选,默认 v0.3.0)
bridge 已内置 v1.0 序列化边界(src/a2a/compat.ts),通过 CURSOR_BRIDGE_A2A_PROTOCOL_VERSION=1.0 启用,无需改代码:
v0.3.0(默认):零回归,沿用既有 Agent Card / Task 形状。
v1.0:Agent Card 的
protocolVersion移入supportedInterfaces['a2a/v1.0'],顶层新增extensions: [];Task/Artifact 的FileContent字段重映射(name→filename、mimeType→mediaType、uri→url、bytes_inline→raw)。message/send/tasks/get/tasks/cancel/message/stream方法名与 JSON-RPC 信封不变。
v1.0 与 v0.3.0 走同一套引擎与同一端口,仅序列化形状不同;建议先在受控环境用下方最小客户端验证 Card/Task 形状后,再对全网客户端切版本。
最小 v1.0 客户端示例(fetch + JSON-RPC):
# 1) 取 v1.0 Agent Card(注意 protocolVersion 已不在顶层,改看 supportedInterfaces)
curl -s http://127.0.0.1:<a2aPort>/.well-known/agent.json | jq '{supportedInterfaces, extensions, name}'
# 2) 派发任务(阻塞等待终态;v1.0 同样用顶层 taskId + parts[].text)
curl -s -X POST http://127.0.0.1:<a2aPort>/a2a \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"message/send","params":{
"message":{"role":"user","parts":[{"text":"在 demo 仓库加一个 hello 函数"}],
"messageId":"m1"},
"configuration":{"blocking":true,"acceptedOutputModes":["text/plain"]}}}'
# 3) 取回 Task,校验 v1.0 FileContent 形状(filename/mediaType/url/raw)
curl -s -X POST http://127.0.0.1:<a2aPort>/a2a \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tasks/get","params":{"id":"<taskId>","historyLength":10}}' \
| jq '.result.artifacts[]?.parts[]? | select(.file) | .file | {filename, mediaType, url}'配置
%LOCALAPPDATA%\wb-cursor-bridge\config.json(也可用同名环境变量覆盖):
键 / 环境变量 | 默认 | 说明 |
|
| Cursor CLI 路径 |
| 空 | 允许的仓库根, |
|
| 索引、日志、产物 |
|
| 单任务墙钟上限 |
|
| 超限快速失败 |
|
| 开启后提供 |
| 空 | 设置后 |
| 空 | 设置后每个 job 的事件会异步追加到 |
|
| 设为 |
|
|
|
|
| 设为非 0 后暴露 A2A HTTP 服务面(Agent Card + JSON-RPC) |
|
| 监听地址;设 |
| 空 | 设置后 A2A 端点(含 |
| 空 | 对外可达地址,用于 Agent Card 中的 |
| 空 | 逗号分隔的受信 webhook 主机白名单;开启 push 且目标为私有/loopback 时必须命中此项(SSRF 防护逃逸口) |
|
| A2A 协议版本;设为 |
|
|
|
|
|
|
| 空 | 逗号分隔的允许跨域 origin 列表;命中时反射 |
| 空 | 额外 skill 声明( |
安全模型
工作区白名单:路径需同时通过字面与 realpath 双重校验;拒绝
..越界、符号链接逃逸、NUL 字节、DOS 保留设备名、8.3 短名。进程隔离:
execute永远在独立 git worktree 内执行;Windows 上用taskkill /T /F杀整棵进程树,POSIX 上杀进程组。资源上限:超时强杀、并发上限、结果体积上限、事件环形缓冲、job LRU。
审计:任务索引与产物原子落盘;可选开启事件 JSONL 持久化(
CURSOR_BRIDGE_PERSIST_EVENTS=1)以满足强审计需求。崩溃后重启会把遗留running任务标记为orphaned。stdout 洁癖:任何
console.log都被重定向到 stderr,避免污染 JSON-RPC 流。
bridge_stats中的totalDurationMs是进程内运行时计数,长期运行后可能丢失整数精度;需要长期精确统计时请外部系统定期拉取/stats后重启 bridge。
⚠️ MCP server 不受调用方沙箱与审批策略约束 —— bridge 本身就是策略边界。 白名单、worktree、超时、并发、审计必须全部保留,不要为了方便关掉。
开发
npm install
npm run typecheck # tsc --noEmit
npm test # 97 项:49 单元 + 15 端到端 + 3 admin HTTP + 30 A2A
npm run test:stress # 压力:高并发 / 反复 cancel-reply / hang 超时
npm run test:fault # 故障:磁盘/权限异常的优雅降级
npm run verify # 门禁:typecheck + npm test + stress + fault + release 构建
npm run test:a2a # 仅跑 A2A 互操作 30 项(Agent Card / message/send / tasks/get / cancel / stream / push / auth / blocking / 协商 / 限流 / CORS / v1.0 / skills)
npm run verify:e2e # 端到端真跑实证:真实 dist 二进制 + fake-agent,54 项(v0.3.0/v1.0/鉴权/限流/CORS/产物可达/input-required 续跑/push 真投 + SSRF 拒绝/tasks/cancel 真实取消与清理/崩溃清理…),已纳入 Linux CI 门禁(脚本已跨平台可跑,Windows CI 待验证后启用)
npm run build # 编译到 dist/
npm run build:release # 产出 release/wb-cursor-bridge-v<version>-win-x64.zip
npm run verify # 上述全流程(不含 stress/fault)端到端测试用一个模拟 agent 二进制(test/fake-agent.mjs)讲同一种 stream-json 协议,因此无需 Cursor 账号或网络即可验证全链路。真实 Cursor CLI 集成见下文。
PowerShell 脚本测试(安装器会重写用户配置,值得单独跑):
pwsh -File test/mcp-config.test.ps1目录结构
src/
index.ts 入口:协议装配、stdout 保护、优雅关闭
config.ts 配置解析与校验
tools.ts 9 个 MCP 工具的定义与分发
runner.ts 任务调度、worktree 托管、指标、input-required 续跑
store.ts 任务仓库:持久化、LRU、崩溃恢复
a2a/ A2A v1.0 语义层:types / convert / card / skills / watch / server
logger.ts 分级日志 + JSONL 轮转(按写入次数触发 stat)
admin.ts 可选 HTTP 运维端点(shutdown 支持 token)
version.ts 版本号唯一来源(测试断言与 package.json 一致)
cursor/
cli.ts Cursor 调用、进程管理、结果装配
parse.ts stream-json 解析(容错)
util/
paths.ts Windows 感知的路径白名单
processes.ts 跨平台进程树终止
git.ts worktree 生命周期与产物抓取
ndjson.ts 增量 JSON 行读取
scripts/
build-release.mjs 单文件打包 + ZIP(自实现 zip writer,零依赖)
install.ps1 一键安装
uninstall.ps1 卸载
lib/ 安装器共享库(MCP 配置合并)故障排查
现象 | 处理 |
|
|
| 任务路径不在白名单内,检查 |
| 调高 |
任务一直 | 用 |
启动即退出码 2 | 配置非法,看 |
MCP 工具没出现 | 确认配置写在 |
想看实时状态 | 设 |
shutdown 端点 401 | 设置了 |
A2A 端点 401 | 设置了 |
A2A 控制面暴露告警 | 把 |
push 通知没生效 | 开启 push 必须设置 |
版本历史
完整变更记录见 CHANGELOG.md。
版本 | 要点 |
0.4.0 | A+ 路线图收尾:消费 |
0.3.4 | A2A 真互联:Agent Card 发现 + JSON-RPC 语义层(message/send、tasks/get、tasks/cancel、message/stream SSE、push 通知、Bearer 鉴权);生产级硬化(LRU 保 input-required、文件产物可寻址、SSRF 防护、资源/并发修复、/healthz /metrics /version),83 项测试 |
0.3.3 | P3 加固:可选事件 JSONL 持久化、压力/故障测试、Node 镜像与离线包、Windows CI、metrics 说明 |
0.3.2 | P1/P2 风险消除:参数 limit 钳制、kill 结果记录、persist 失败告警、同步 shutdown、构建后 smoke |
0.3.1 | 全仓审计修复:安装器升级停不掉旧进程、 |
0.3.0 | health 缓存、admin shutdown token、 |
0.2.0 | 首个工程化版本:9 工具、bridge 托管 worktree、win-x64 一键安装 |
真实 Cursor CLI 集成
仓库默认使用 test/fake-agent.mjs 跑测试,不依赖 Cursor 授权。若要在真实 Cursor CLI 上验证:
安装 Cursor CLI 并确认
agent.exe --help可用。在 Windows PowerShell 执行:
$env:CURSOR_BIN = 'C:\Users\<you>\AppData\Local\Programs\cursor\bin\agent.exe'
$env:CURSOR_BRIDGE_WORKSPACE_ROOTS = 'C:\src\demo'
node --test test/e2e.test.mjs或手动触发
.github/workflows/real-cursor-snapshot.yml,填写cursorBin与workspaceRoots。
真实 Cursor 的输出字段可能随版本漂移;遇到解析失败请在 bridge.log 中抓取原始行并提 issue。
文档与报告
本仓库随附以下设计、审计与变更文档,建议按"方案 → 审计 → 变更"的顺序阅读:
文档 | 内容 |
项目说明、一键安装、工具(9 个)、A2A 服务面、配置表、排障、版本历史 | |
语义化版本变更记录(0.2.0 → 0.4.0),版本号来源唯一( | |
A+ 生产级全栈审计与路线图:六维审计 + Phase 0–3 落地 + 端到端真跑实证(54/54 检查全绿) | |
A2A v0.3.3 专项审计报告(Agent Card / message/send / tasks / stream / push / auth 对照表) | |
v0.3.3 全仓审计报告 | |
原始方案设计:双智能体互操作架构、控制面/数据面划分、WorkBuddy↔Cursor 治理边界 |
阅读建议:先看方案理解架构动机与治理边界,再读 A+ 审计报告了解生产级演进路线与真跑实证结论,最后按需在 CHANGELOG 回溯细节。
License
MIT
Available Tools
9 toolsbridge_healthA
Preflight diagnostics: binary resolution, workspace allowlist, state directory writability, concurrency and metrics. Run this first when a task fails for unclear reasons.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does unusually well by disclosing the internal checks performed. It leaves one meaningful gap: a writability probe may touch the filesystem, and the description never states whether the tool is side-effect-free or how failures are surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, with the diagnostic scope front-loaded before the usage trigger. Every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param tool with no output schema, the description implies a diagnostic report but does not say what form it takes or whether an unhealthy result surfaces as an error versus a report body. Given the low complexity, this is a minor rather than blocking gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline 4 applies. No parameter claims are made that could conflict with the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Enumerates the specific checks performed (binary resolution, workspace allowlist, state directory writability, concurrency, metrics), which is far more informative than a generic 'health check'. It is distinguishable from bridge_stats and bridge_shutdown by scope, though it does not name those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Run this first when a task fails for unclear reasons' gives a concrete triggering condition and ordering priority. It stops short of naming alternatives (e.g. when to prefer bridge_stats) or stating when not to run it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bridge_shutdownB
Cancel all in-flight jobs, flush state and exit. Use before restarting the bridge so no Cursor process is left orphaned.
| Name | Required | Description | Default |
|---|---|---|---|
| graceMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden, and it does disclose the primary effects: in-flight jobs are cancelled and state is flushed before exit. It omits whether the shutdown is irreversible, what happens to results of cancelled jobs, whether the process can be restarted, and whether any permissions are required — significant gaps for a destructive/terminal operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler, purpose front-loaded ahead of the usage note. Efficient, though the second sentence could have carried the grace-period detail at no cost to length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-annotation, no-output-schema shutdown tool, the description covers what it does and one usage context, but leaves the single parameter and the irreversibility/permission story unexplained. An agent could call it, but not confidently predict the consequences of graceMs or of a mid-flight job.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter, graceMs, with 0% schema description coverage and no mention anywhere in the description. Since the schema provides nothing, the description needed to explain what the grace period governs (drain time before hard kill?) and its default; it does neither.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and effect: 'Cancel all in-flight jobs, flush state and exit' — an agent knows exactly what the call does to the bridge. It stops short of distinguishing itself from the sibling cursor_cancel, which also plausibly cancels jobs, so the boundary between 'cancel one job' and 'shut down everything' is only implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete triggering condition: use before restarting the bridge to avoid orphaned Cursor processes. However, it names no alternatives (e.g. cursor_cancel for partial cleanup) and gives no 'do not use during X' exclusions, so an agent must infer the safety envelope itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bridge_statsA
Counters for job outcomes, tier mix and duration, for capacity planning.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden. 'Counters' implies a read-only, non-mutating call and the enumeration of metric categories gives some idea of the payload, but nothing states whether the read is non-destructive, whether it is cached or point-in-time, or what a single row/record looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the metric scope is stated before the purpose. It is efficient but perhaps under-specified for a stats endpoint an agent will need to interpret.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations to carry return-shape or safety information, so the description should say more about the structure of the counters (unit, aggregation window, dimensions). It names the metric families but leaves format and semantics of the returned values unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the schema carries no semantic load and the baseline of 4 applies. The description adds no misleading parameter implications.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific resource (counters/metrics) and enumerates what is measured: job outcomes, tier mix, and duration. That is well beyond a restatement of the name. It does not, however, differentiate itself from the closest sibling bridge_health, which an agent might reasonably confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The trailing phrase 'for capacity planning' implies the intended use case, but there is no explicit guidance on when to call this versus bridge_health, nor on how often or in what context to refresh the counters. Usage is only inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cursor_cancelB
Cancel a running job and kill its entire process tree.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it does valuable work by disclosing that cancellation kills the entire process tree, i.e. that this is destructive and broader than a single process. It omits irreversibility, whether confirmation is required, and behavior when the job is already finished or unknown.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with the destructive scope front-loaded; there is no filler and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should explain the sole required parameter and the effect of an unsuccessful cancel. It covers the destructive scope well but leaves the parameter entirely undocumented, which is the main gap for a one-parameter mutation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single parameter 'jobId' has no description in the schema or the description text. The agent is not told where to obtain a jobId (presumably from cursor_run or cursor_list) or whether partial IDs are accepted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Cancel') and resource ('a running job') and adds scope ('entire process tree'). It is clearly distinct from siblings like cursor_run or cursor_status, though it never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'a running job' hints that the target must be active, but there is no explicit when/when-not guidance, no mention of alternatives such as cursor_status for checking state first, and no prerequisites or confirmation expectations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cursor_diffA
Inspect what an execute job changed: changed file list, diffstat, and optionally the raw patch text. Use offset/limit to page through a large patch.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes | ||
| limit | No | Max characters of patch to return, 1-200000 | |
| offset | No | ||
| includePatch | No | Include the raw unified diff |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the behavioral burden. It conveys that this is an inspection/read operation with optional raw patch inclusion and paging, but it does not disclose whether the job must be finished, error behavior for invalid job IDs, authentication requirements, or output size limits beyond the patch parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the core purpose and followed by the key paging behavior. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter inspection tool without an output schema, the description is mostly complete: it names the main return components (changed files, diffstat, optional raw patch) and explains paging. It leaves minor gaps around job state requirements and error behavior, but nothing critical for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%, with limit and includePatch documented in the schema. The description adds meaning for offset/limit as paging controls for large patches, but it does not explain the offset semantics or clarify that jobId refers to an execute job beyond the phrase 'execute job changed'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: inspect what an execute job changed, including changed file list, diffstat, and raw patch. It does not explicitly differentiate from siblings like cursor_status or cursor_run, but the 'execute job changed' scope is specific enough for an agent to identify the tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies usage after an execute job and explicitly says to use offset/limit when paging through a large patch. However, it does not state when to use this tool versus cursor_status or cursor_run, nor does it mention prerequisites such as the job needing to be complete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cursor_listB
List recent jobs with status, tier and duration.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max jobs to return, 1-1000 | |
| status | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; "List" implies a read, and it usefully names the returned fields and that results are "recent" (implying recency ordering). It omits the default/max result behavior, ordering guarantees, whether filtering by status still returns recent jobs only, and pagination, so it falls short of full disclosure for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is economical, though the terseness is part of why usage and parameter guidance are missing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, unannotated two-optional-param read tool with no output schema, naming the returned fields covers the main gap. Still missing are the default limit, result ordering, and any differentiation from cursor_status, but the core call path is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: `limit` is documented in the schema while `status` relies entirely on a self-explanatory enum. The description adds nothing about the parameters — it mentions "status" only as a returned field, not as a filter — but for a two-parameter tool with a clear enum, the schema does most of the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("List recent jobs") plus the fields returned (status, tier, duration), so the agent knows what it gets. It does not, however, distinguish this from the sibling cursor_status, which an agent could plausibly confuse with a per-job status lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance: nothing says whether to call this to discover job IDs before cursor_status, or to poll for completion. No alternatives (cursor_status, cursor_list vs. run) are named, and no prerequisites or exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cursor_replyA
Send input to a job. If the task is paused in the A2A input-required state, this RESUMES the SAME task (same job id, thread preserved) — input-required -> working -> completed. Otherwise it spawns a child follow-up job that resumes the Cursor thread. Cancel a running job before replying.
| Name | Required | Description | Default |
|---|---|---|---|
| tier | No | ||
| jobId | Yes | ||
| prompt | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and discloses meaningful behavior: same job id and thread preserved, the state transition (input-required -> working -> completed), and a cancel prerequisite. It does not say whether the child follow-up inherits permissions or what the response looks like, but the core behavioral model is well conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense and front-loaded: the primary verb+resource leads, then the two behavioral branches, then the cancel caveat. Nearly every clause earns its place, with only mild repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so returns are less critical, and the behavioral logic is covered. But with 4 uncovered parameters/enum values and no annotations, the definition leaves the agent guessing on parameter semantics and the meaning of tier — a real gap for a 3-param tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate, but it says nothing about jobId, prompt, or the tier enum (consult/plan/execute). 'input' and 'job id' are mentioned only in passing, leaving all three parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Send input to a job') and then differentiates two distinct behaviors: resuming a paused task vs. spawning a child follow-up job. This is clear and specific, though it never names a sibling tool directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the condition that selects the resume path ('paused in the A2A input-required state') versus the child-job path, and adds a precondition ('Cancel a running job before replying'). Lacks an explicit tie to cursor_cancel by name, but the guidance is actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cursor_runA
Dispatch a task to the Cursor sub-agent and return a job id IMMEDIATELY. This tool never blocks: a real code task takes minutes, so poll with cursor_status. tier=consult is read-only Q&A, tier=plan is read-only planning, tier=execute may write files and is always isolated in a git worktree.
| Name | Required | Description | Default |
|---|---|---|---|
| tier | Yes | ||
| model | No | Optional Cursor model id | |
| prompt | Yes | The task for the Cursor agent | |
| workspace | Yes | Absolute path, must be inside a configured workspace root | |
| timeoutSec | No | Wall-clock ceiling for this job |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses asynchronous non-blocking behavior and that execute is isolated in a git worktree. It does not cover failure modes, timeouts, or authentication/workspace-root requirements beyond what the schema states.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the key fact (dispatch and return immediately, never blocks) and follows with polling instruction and tier semantics. Every sentence adds information; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, but the description states the return is a job id, which is the essential return value. It lacks detail on what happens on failure or how cursor_reply/cursor_cancel interact, but an agent has enough to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 80%, so the baseline is 3, but the description adds substantial meaning for the tier enum (read-only vs. write-capable, worktree isolation) that the schema enum alone does not supply. model and timeoutSec are left entirely to the schema, so it does not fully compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Dispatch a task to the Cursor sub-agent') plus the immediate return ('job id'). It distinguishes itself from the sibling query tools by emphasizing that it never blocks and defers results to cursor_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent to poll with cursor_status because a real task takes minutes. It also gives selection guidance among the tier options: consult/plan are read-only Q&A/planning, execute may write files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cursor_statusB
Poll a job. Pass waitSeconds (max 55) to block briefly until it settles, and since to receive only new events.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes | ||
| since | No | Return only events after this cursor | |
| waitSeconds | No | Seconds to wait, 0-55 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions blocking briefly until the job settles and cursor-based event filtering, but it omits important behavior such as timeout handling, error cases, permissions, and what the response contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action. Every sentence provides useful invocation detail without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description should explain what polling returns. It explains how to call the tool but not what job status or events the agent will receive, leaving a significant gap for a status-check tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema documents since and waitSeconds, and the description reinforces their meaning. However, jobId is undocumented in both the schema and the description, and the description adds little beyond the schema for the two described parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Poll a job.' This distinguishes it from sibling tools like cursor_run, cursor_cancel, and cursor_list. It does not explicitly name alternatives, but the purpose is clear enough to select the tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through 'Poll a job' and explains how to use waitSeconds and since. However, it gives no explicit when-to-use guidance, no exclusions, and no comparison to alternatives such as cursor_list or cursor_diff.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.4.0- First observed
bridge_health - First observed
bridge_shutdown - First observed
bridge_stats - First observed
cursor_cancel - First observed
cursor_diff - First observed
cursor_list - First observed
cursor_reply - First observed
cursor_run - First observed
cursor_status
TDQS
Scored across 9 tools
Each tool targets a distinct lifecycle step: dispatch, poll, reply/resume, cancel, list, diff inspection, stats, health, and shutdown. The only potentially close pair, cursor_run and cursor_reply, is clearly separated by starting a new job versus resuming or following up on an existing one. No tool appears to duplicate another's purpose.
Names consistently use snake_case with a stable resource prefix: cursor_* for job operations and bridge_* for bridge-level operations. The pattern is predictable and reflects the underlying domain grouping. Minor noun/verb variation (cursor_status, bridge_health) does not undermine consistency.
Nine tools is well-scoped for an asynchronous job bridge, covering dispatch, polling, interaction, cancellation, inspection, diagnostics, and shutdown. Each tool appears to earn its place without obvious filler. The surface is neither thin nor bloated.
The tool set covers the full job lifecycle, including execution, polling, replying/resuming, cancellation, diff inspection, metrics, health checks, and shutdown. A minor gap may exist around explicitly retrieving a finalized job result or artifacts beyond status events and diff output, but agents can likely work around it via cursor_status.
Maintenance
Related MCP Connectors
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Agent-first task marketplace MCP — discover, claim, and deliver paid workspace tasks.
Connect, monitor, and control AI agents — tasks, approvals, schedules, and governance.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA control plane for AI agents and human supervisors. Persistent task registry with scoped permissions, inter-agent delegation, and full provenance — all accessible via MCP. Deploy on Supabase free tier in 3 commands.27 npm11Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables programmatic control of Cursor's cloud-based AI agents for automated code generation and repository management via standardized MCP tools.5 npm6MIT
- AlicenseAqualityBmaintenanceMCP server that lets any agent or MCP host delegate tasks to the Cursor CLI agent for fast, headless execution. Supports task delegation, project discovery, file analysis, and follow-up sessions.314 npm3MIT
- AlicenseAqualityBmaintenanceEnables supervising and orchestrating local coding agents like Muse and AGY through a client-agnostic MCP interface, with isolated Git worktrees, safe execution, and deterministic verification.107 npmMIT