cursor-relay-mcp
This server lets MCP clients delegate bounded tasks to a selected Cursor model and manage durable, restart-safe, explicitly authorized local workspace runs.
Run diagnostics with
doctorto check config, authentication, and persistence without calling Cursor models.Discover available models, aliases, and parameters with
list_modelsbefore starting a run.Issue short-lived, one-time, read-only workspace authorization tokens via
authorize_workspacewhen the user explicitly approves a workspace in the conversation.Start persistent Cursor Agent runs with
start_run, requiring workspace, task, model, and idempotency key; default permission is read-only, with guardedworkspace-writeanddanger-full-accessoptions.Continue a finished agent session under the same agentId with
reply_run.Inspect or recover runs after restart with
get_run, poll withwait_run(max 30s, call again when not terminal), and cancel withcancel_run.List persisted relay runs with
list_runsand page through streamed events withread_events, including truncation metadata for large event data.Enforce security defaults: static workspace allowlist for unattended runs, bounded permissions, sandbox on supported non-Windows hosts, idempotent/recoverable operations, and no secret persistence (optional
CURSOR_API_KEYfor automation).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@cursor-relay-mcpstart a run to review the recent code changes and suggest improvements"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
cursor-relay-mcp
A local MCP server built on the official @cursor/sdk. It lets MCP clients delegate a bounded task to an explicitly selected Cursor model while keeping durable, restart-safe run state.
@cursor/sdk is public beta. This package pins exactly 1.0.30 and includes an SDK export contract test. See README.zh-CN.md for the full guide.
For a tested Codex Desktop installation workflow on Windows, including personal marketplace layout, CLI fallback, sandbox compatibility, cache refresh, and a Grok 4.6 smoke test, see CODEX_INSTALL.zh-CN.md.
Updating another computer: Pull, build, reinstall, then verify native tools and a real read/write task in a new Codex task. Preserve active runs and local state. See the upgrade checklist.
Codex built-in MCP contract
The Codex plugin manifest references the packaged MCP declaration with
"mcpServers": "./.mcp.json". The packaged .mcp.json must start
node ./dist/index.js with cwd: ".". Codex resolves that working directory
against the installed plugin version root. Do not hard-code a development checkout
or a versioned Codex cache path, duplicate the same server in user config.toml, or
put CURSOR_API_KEY in the MCP declaration.
After installing or reinstalling the plugin, create a new Codex task. Codex loads
the bundled Skill and starts the built-in MCP automatically. It sends only the
workspace path, targetLocations (files, directories, or line locations), a
bounded task scope, model, permission, and idempotency data. The Cursor Agent
reads the authorized workspace itself. Both read-only and workspace-write
reject source text, code fences, file contents, and diffs in MCP arguments. An
explicit request for Cursor to review a current or named
workspace authorizes in-scope reading, not secrets, unrelated paths, or edits. An
explicit request to modify or fix must map to workspace-write, not be silently
downgraded to analysis. Outside the static allowlist, authorize_workspace
issues a reusable capability bound to the current Codex conversation and exact
workspace; it supports both read-only and workspace-write.
The plugin ships its Codex Skill inside the original package at
skills/delegate-to-cursor-agent/SKILL.md. The manifest declares
"skills": "./skills/", and the npm package includes skills/, so installing
or reinstalling the plugin makes Codex load the Skill automatically in newly
created tasks; no install-time Skill generation is needed.
Related MCP server: Wolbarg Coordination for Cursor
Quick start
Requirements: Git, Node.js >=22.13, and a Cursor account. The recommended
authentication method is the official Cursor.auth.login() stored login.
git clone https://github.com/tonytanglab/cursor-relay-mcp.git
cd cursor-relay-mcp
npm install
# Opens the system default browser and stores an official SDK login for this OS user.
node --input-type=module --eval 'import { Cursor } from "@cursor/sdk"; await Cursor.auth.login({ apiKeyName: "cursor-relay-mcp" })'
npm run build
$env:CURSOR_RELAY_WORKSPACE_ROOTS = "D:\app\git"
node .\dist\index.jsRun the login once on each computer and OS user account that starts the MCP server. The official SDK opens the system default browser, mints a named, expiring and revocable API key, and stores it in its official credential store; the relay never reads or returns the key value. Check the login without exposing credentials:
node --input-type=module --eval 'import { Cursor } from "@cursor/sdk"; console.log((await Cursor.auth.status()).status)'logged-in means the MCP process can use stored login. CURSOR_API_KEY remains
an optional alternative for automation, but do not put it in .mcp.json, shell
history, logs, or the repository. When using stored login, omit
CURSOR_API_KEY entirely instead of setting it to an empty string.
The normal tool flow is doctor → list_models → start_run → repeated wait_run calls until terminal=true. The SDK stored login is independent of the Cursor desktop login; after explicit user confirmation, reauthenticate_cursor can replace a mismatched SDK login without exposing its API key. Runs are idempotent and persisted; the owning executor enforces its total timeout. New runs use workspace-scoped SQLite, while legacy JSONL remains read-only. Reattaching after a restart observes persisted events; it does not restart execution. Stop unconditional polling when needsAttention=true, and do not automatically cancel or resubmit an unknown run.
For start_run and reply_run, task means review/implementation scope and
acceptance requirements, never file contents. Use targetLocations for
workspace-relative files, directories, or line locations. If a reply omits them,
it inherits the parent locations. The Relay builds the Cursor instruction so the
agent reads the authorized workspace directly; authorization does not relax this
contract for either read-only or read/write runs.
doctor reports the effective defaultTimeoutMs and maxTimeoutMs. Ordinary
repository work should normally omit timeoutMs and use the configured default
(24 hours by default and also the hard maximum). Callers may request a shorter
explicit budget when appropriate, but cannot raise a run above 24 hours. A
wait_run timeout is only a polling slice. Retryable SDK reconnects are returned as
connection.state=reconnecting and remain non-terminal.
While status and events show healthy progress, callers should keep waiting within
the run budget instead of cancelling or creating short continuation runs.
After start_run or reply_run, call open_run and share its clickable
progressUrl. This read-only loopback page bypasses MCP App sandbox failures.
Links are bound to one run, expire after 24 hours, and stop working when their
MCP process exits; call open_run again with the original run ID, never resubmit
the task to fix a display error. Do not share these capability links externally.
view_run remains an optional embedded panel. Data tools no longer attach a
widget, avoiding redundant sandbox frames. Both viewers use read_run_progress
for persisted snapshots and the latest 200 incremental events; viewing never
attaches to the SDK, settles a timeout, or mutates a run. A persisted running
status is not proof of liveness: callers must still monitor with wait_run.
The panel retries read failures, shows recovery errors, and releases timers
and old events. No network fonts, scripts, or external services are used.
The pinned public Cursor SDK has no operation for injecting a new instruction
into an active local Agent run. The relay therefore reports
doctor.capabilities.activeRunSteering=false and never treats an internal event
append as successful steering. A caller must not cancel merely to redirect: it
should keep observing and use reply_run after terminal state. Cancellation is
reserved for an explicit stop request or a concrete safety boundary.
Security defaults are fail-closed: unattended runs require the static workspace
allowlist. When a user explicitly authorizes Cursor Relay for a workspace in the
current conversation, authorize_workspace can issue a reusable read-only or
workspace-write capability. The token is never persisted and is bound to the
real path, granted permission ceiling, and MCP task/session when available. A
workspace-write capability can also run read-only tasks; a read-only capability
cannot be elevated. It expires when that conversation scope or MCP process ends.
Permissions otherwise default to read-only, the Cursor sandbox is enabled by
default on supported non-Windows hosts, and only project settings are loaded.
Windows defaults the SDK sandbox off because the current local runtime reports
it as unsupported; the read-only tool allowlist remains enforced. Both normal
presets expose Cursor's official webSearch and webFetch tools so Cursor can
decide whether network research is relevant.
danger-full-access still requires the static allowlist plus both
CURSOR_RELAY_ENABLE_DANGER_FULL_ACCESS=true at server startup and
confirmedDangerousPermission=true on the request. Leave the server switch off
for normal use.
CURSOR_RELAY_READ_ONLY_SANDBOX_ENABLED can explicitly disable the sandbox on
supported non-Windows hosts. Windows always clamps this setting off because the
current Cursor SDK local runtime does not support that sandbox path. This switch
applies only to the read-only preset; its public tool allowlist remains
restricted to read, grep, glob, ls, webSearch, and webFetch by
default.
The workspace-write sandbox follows the same platform compatibility rule: it is
enabled by default on supported non-Windows hosts and clamped off on Windows,
while the exact workspace authorization and disallowed-tool list remain enforced.
delete, task, mcp, and generateImage are controlled by the Codex main
process rather than being permanently unavailable. start_run and reply_run
accept codexAllowedTools; omitted reply values inherit the parent policy and
an empty array revokes it. Read-only runs may additionally allow only
generateImage; the other controlled tools require workspace-write. Ordinary,
reversible actions already covered by the user's request need no separate prompt.
Human confirmation is reserved for materially destructive, broad, irreversible,
out-of-scope, externally consequential, or danger-full-access actions.
CURSOR_RELAY_SETTING_SOURCES is an optional comma-separated list restricted
to the public project, team, and mdm setting layers. It defaults to
project; user, plugins, and all are deliberately rejected to avoid
ambient or recursive MCP behavior.
Run summaries omit streamed events and report eventCount; use read_events
for event pages. Event data larger than 8 KiB is replaced with explicit
truncation metadata. Redaction is based on sensitive field names and is not a
general secret scanner, so use a private state directory and avoid secrets in
prompts.
The relay uses only public exports from the pinned SDK: model discovery,
Agent.create/resume/listRuns/getRun, Run.stream/wait/cancel, and
official authentication status. It does not inspect Cursor IDE state or private
endpoints. Restarting the Cursor IDE is not required for local SDK runs.
Verification
npm run format:check
npm run lint
npm run typecheck
npm test
npm run build
npm run test:mcp
npm run check:package
npm run test:sdk-contractThe default tests do not call the real Cursor API or modify a real workspace.
Available Tools
10 toolsauthorize_workspaceA
仅当用户在当前对话明确要求 Cursor Relay 使用该工作区时调用。为一个精确任务和幂等键签发五分钟有效、一次性、只读的工作区授权;不授予写入或危险权限。
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | ||
| workspace | Yes | ||
| permission | No | ||
| idempotencyKey | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds valuable behavioral context beyond annotations: the authorization is five-minute valid, one-time, read-only, and does not grant write or dangerous permissions. Annotations are all false and provide no details. This disclosure helps an agent understand the tool's side effects and limitations. No contradiction with annotations since the read-only refers to the granted permissions, not the tool's own operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a concise two-sentence structure that front-loads the usage condition, then explains the action and constraints. Every word earns its place; there is zero fluff. It is highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters and 0% schema coverage, the description should explain each parameter and edge cases. It covers the core purpose and constraints, but omits details like what constitutes a valid workspace, task description, and the behavior on idempotency key reuse. It is adequate but not thorough for a tool with such sparse schema annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter explanations. However, it only hints at 'precise task' and 'idempotency key' without defining what each parameter means, their formats, or constraints. The 'permission' const is read-only, which aligns with the description, but the other three parameters lack explicit semantic detail. This is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('签发', issue) and resource (workspace authorization), and clearly delineates the tool's function: issuing a temporary, one-time, read-only authorization for a precise task. It also gives the exact condition for invocation, distinguishing it from sibling run-management tools without needing to name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to call: only when the user explicitly requests in the current conversation to use that workspace. This is a strong conditional. However, it does not mention any alternative tools or when not to use it, but given the siblings are about runs, the context is sufficient. The explicit trigger condition warrants a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cancel_runCDestructiveIdempotent
取消仍在执行的 Cursor SDK 运行;重复取消具有稳定结果。
| Name | Required | Description | Default |
|---|---|---|---|
| relayRunId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true. The description's note about 'stable results on repeated cancellation' merely restates the idempotency hint without adding new behavioral context, such as what happens to the run, side effects, or permissions required. It adds no value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no fluff. It states the core action and the idempotency property efficiently. The structure is front-loaded with the primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (one parameter, no output schema), the description is minimal. It omits key contextual details like the effect on the run lifecycle (e.g., will it stop emitting events?), whether cancellation is reversible, or any return value. An agent would have to infer behavior from the annotations alone, making the description insufficient for full understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the parameter 'relayRunId' is not documented in the schema, and the description does not explain it. Although the name is somewhat self-explanatory, the description fails to compensate for the lack of schema documentation, providing no clarification on its format, purpose, or expected values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'cancel a still-running Cursor SDK run', specifying the verb (cancel) and resource (run). It is distinct from sibling tools like start_run, get_run, etc., though it does not explicitly name alternatives. The purpose is unambiguous and sufficiently specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for runs that are still executing ('仍在执行'), but it provides no explicit guidance on when to use it versus alternatives like wait_run or how it relates to other lifecycle operations. No exclusions or conditions are given beyond the implicit 'still running' state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
doctorARead-onlyIdempotent
检查 Cursor Relay 配置、认证与持久目录;不调用 Cursor 模型。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds valuable behavioral context by specifying the exact items checked (config, auth, persistence) and explicitly stating it does not invoke the Cursor model, which goes beyond the annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no extraneous words. It front-loads the core purpose and includes an explicit exclusion, making it concise and highly scannable for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only diagnostic tool, the description covers purpose, scope, and the explicit non-action. It lacks detail on the output format, but given the simple nature and no output schema, this is a minor gap. The description is sufficiently complete for an agent to decide when to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description provides context on what the tool inspects without needing to explain parameters, which is appropriate for this parameterless diagnostic tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks Cursor Relay configuration, authentication, and persistence directory, and explicitly notes it does not call the Cursor model. This distinguishes it from sibling run-management tools that interact with models, providing a specific verb and resource scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a diagnostic role by listing what it checks and what it avoids, but it does not explicitly state when to use this tool versus alternatives. It lacks guidance on pre-flight checks or when to prefer it over other operations, leaving usage context to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_runBRead-onlyIdempotent
读取一个持久运行的当前状态,并在进程重启后自动重连 Cursor SDK 运行。
| Name | Required | Description | Default |
|---|---|---|---|
| relayRunId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so safety is covered. The description adds the auto-reconnect behavior after process restart, which is useful context not captured by annotations. However, it doesn't disclose error behavior (e.g., what if the run doesn't exist) or whether the state includes partial output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that states purpose and a key behavioral detail. It is concise and well-structured, with no superfluous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter and strong annotations, the description is adequate but not complete. It lacks details about the return value (e.g., what 'current state' contains), error scenarios, or whether it paginates. The auto-reconnect note adds some context, but more would be needed for an agent to anticipate behavior fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% (no parameter descriptions). The sole parameter 'relayRunId' is not explained in the description; the name hints at a run identifier but the description doesn't elaborate on format, origin, or relationship to start_run. The description does not compensate for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('get current state') and the specific resource (a persistent run). It distinguishes from siblings like list_runs (which lists all runs) and wait_run (which waits), making its purpose clear, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, when to prefer it over list_runs or wait_run, or any exclusions. The description implies usage for reading run state but leaves selection to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_modelsARead-onlyIdempotent
从当前 Cursor 账户发现可用模型、别名与参数;start_run 前应调用。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, and non-destructive hints. The description adds context about using the current account and the ordering requirement relative to start_run, which is useful behavioral information beyond the annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that front-loads the purpose and usage. Every word earns its place; there is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, zero-parameter, read-only listing tool, the description adequately specifies what it returns (models, aliases, parameters) and when to call it. With no output schema, it does not explain return structure in detail, but the listed items suffice for an agent to understand the outcome.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description correctly implies no inputs are needed; it adds no parameter-specific information because there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('discover') on a specific resource ('available models, aliases, and parameters') from the current Cursor account. It also distinguishes itself from siblings by explicitly referencing start_run, making the tool's role unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit timing guidance ('should be called before start_run'), establishing when to use it. It does not mention when not to use it or alternatives, but the context is clear and the directive is direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_runsBRead-onlyIdempotent
按创建时间倒序列出 Relay 持久运行。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
注释已声明readOnlyHint=true和destructiveHint=false,覆盖了安全性。描述额外提到排序方式(创建时间倒序),这是注释未提供的。但未提及返回格式、分页或任何限制,这些对于此类工具是常见的。由于注释已提供基本安全信息,描述本身无需重复,但补充的价值有限。
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
描述仅有一句话,简洁明了,没有任何冗余内容。它直接陈述了核心功能和排序方式,结构清晰。虽然省略了部分细节,但就所包含的信息而言,做到了精炼。
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
该工具参数简单(单可选limit),注释齐全,且无输出schema要求。描述提供了排序行为,但未提及如何设置limit或默认行为。对于这样一个基本工具,描述基本足够,但缺少参数使用说明使上下文略有缺口。
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
输入schema中只有一个可选参数limit,带有最小/最大约束,但schema描述覆盖率为0%。描述完全未提及limit参数的含义或用法,因此代理必须自行推断。虽然'limit'直观代表数量限制,但描述未明确说明,使得参数语义不清晰。
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
描述明确说明了工具的功能:按创建时间倒序列出运行记录。动词'列出'和资源'运行'清晰,且排序方式提供了具体行为。虽然未与其他兄弟工具明确区分,但该描述足以让代理理解基本用途。
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
描述未提供任何关于何时使用该工具与替代工具(如get_run、cancel_run)的明确指导。代理无法从描述中得知适用的场景或与其他列表类工具的区别,仅能通过名称推断。
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_eventsCRead-onlyIdempotent
按递增序号读取已持久化的 Cursor SDK 流事件。事件数量有上限。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| relayRunId | Yes | ||
| afterSequence | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the increasing-order behavior and the fact that the number of events is capped, which goes beyond annotations. However, it does not disclose whether reading consumes events, how pagination works, or the exact nature of the persisted stream.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler. It front-loads the action and the ordering, which is efficient. However, it is under-specified, so conciseness comes at the cost of completeness, but for what it says, there is zero waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With three parameters, no parameter descriptions in the schema, and no output schema, this tool requires more context. The description omits critical usage details: how to obtain relayRunId, the meaning and effect of afterSequence, how the limit is applied, and what the returned events look like. It is far from complete for an agent to call correctly without additional context or trial-and-error.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the three parameters (limit, relayRunId, afterSequence). It fails to explain any of them. The only hint is 'events have a limit,' which loosely relates to the limit parameter but is not explicit. No mention of what relayRunId identifies or how afterSequence controls incremental reading.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (read), the resource (persisted Cursor SDK stream events), and the ordering (in increasing sequence number). This is specific and distinct from the sibling tools like get_run (run state) or list_runs (list of runs), so an agent can tell it apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention that it should be used after starting a run or polling for streamed events, nor does it exclude cases where get_run or wait_run would be more appropriate. No alternatives are referenced.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_runBDestructiveIdempotent
在一个已结束的 Cursor Agent 会话中发起后续运行,并保留同一 agentId。
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | ||
| model | No | ||
| timeoutMs | No | ||
| permission | No | ||
| parentRunId | Yes | ||
| idempotencyKey | Yes | ||
| workspaceApprovalToken | No | ||
| confirmedDangerousPermission | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, openWorldHint=true, and idempotentHint=true, so the description is not required to repeat those. It adds context about retaining the same agentId, which is useful for understanding continuity, but does not elaborate on side effects, authentication requirements, or potential risks beyond what annotations imply. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose without unnecessary detail. It is appropriately sized for what it states, though it lacks any structured breakdown of use cases or parameters, preventing a perfect score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters, nested objects, no output schema) and the description's brevity, the tool is under-documented. It omits crucial operational details such as return format, error conditions, parameter semantics, and any preconditions beyond 'ended session.' Annotations cover safety, but the description fails to provide enough context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description provides no information about any of the 8 parameters, including required ones like parentRunId, task, and idempotencyKey. With no schema hints and no description compensation, an agent cannot infer the purpose or format of these parameters, making this a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('initiate a follow-up run') and its scoping conditions ('in an ended Cursor Agent session', 'retain the same agentId'), which distinguishes it from sibling tools like start_run that likely start new sessions. The verb and resource are explicit and specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates when to use this tool (for ended sessions) but does not explicitly contrast it with alternatives or state when not to use it. It neither names sibling tools nor provides exclusion criteria, leaving some inference required for an agent to choose between this and start_run or other run-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_runADestructiveIdempotent
在允许的本地工作区启动持久 Cursor Agent 运行。默认只读;必须显式选择模型和幂等键。
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | ||
| model | Yes | ||
| timeoutMs | No | ||
| workspace | Yes | ||
| permission | No | ||
| idempotencyKey | Yes | ||
| workspaceApprovalToken | No | ||
| confirmedDangerousPermission | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and open-world behavior, so the description adds value by specifying the default 'read-only' permission, the persistent nature of the run, and the explicit requirement to choose a model and idempotency key. This extra context helps an agent understand the tool's default behavior and mandatory inputs beyond what annotations alone provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short sentences in Chinese. It front-loads the purpose first, then adds key constraints (default read-only, explicit model/idempotency key). Every word earns its place with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, nested objects, and no output schema, the description covers the core behavior and critical requirements but leaves gaps. It does not mention prerequisites like workspace authorization (sibling `authorize_workspace`) or the `workspaceApprovalToken` parameter, nor what the return value is after starting a run. The description is adequate for a basic understanding but incomplete for a complex tool with multiple security and permission checks.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does address several parameters: 'workspace' (allowed local workspace), 'model' (must explicitly choose), 'idempotencyKey' (must explicitly choose), and 'permission' (default read-only). However, it leaves `task`, `timeoutMs`, `workspaceApprovalToken`, and `confirmedDangerousPermission` unexplained. The partial coverage adds meaning for some params but not all, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'start a persistent Cursor Agent run in an allowed local workspace.' It uses a specific verb and resource, and the distinction from siblings (get_run, cancel_run, wait_run) is implicit through the action of starting a new run. It also adds scope ('allowed local workspace') and clarifies the default read-only nature, making it unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (to start a run) but does not explicitly mention alternatives or when not to use it. It does not reference sibling tools like `authorize_workspace` as a prerequisite or `reply_run` for follow-up interactions. There is no guidance on choosing between this and similar tools, so the usage context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_runCRead-onlyIdempotent
最多等待 30 秒。terminal=false 时 mustCallAgain=true,调用方必须继续轮询。
| Name | Required | Description | Default |
|---|---|---|---|
| waitMs | No | ||
| relayRunId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the description's role is to add behavior beyond that. It does add the polling loop requirement (caller must continue polling if terminal=false), which is useful. However, it does not explain what 'terminal' refers to or what happens on timeout, leaving some ambiguity. This is a moderate addition given the annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence in Chinese with no wasted words. It front-loads the maximum wait time and then states the polling condition. While brief, it is efficient and to the point, though it could benefit from a bit more structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and limited annotations, the description needs to explain the interaction flow. It mentions the 'terminal=false' condition but does not define what terminal is, how the caller receives it, or what the return value looks like. It also does not clarify the role of relayRunId in identifying the run. This is incomplete for a polling tool that an agent is expected to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meaning, but it mentions no parameters at all. The schema only provides basic types and constraints (e.g., waitMs is an integer 0-30000), but the description does not explain the purpose of waitMs or relayRunId or how they affect behavior. This is a significant gap for a 2-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool waits up to 30 seconds, making the primary action clear. However, it does not differentiate from sibling tools like get_run, which could also be used for polling run status. The 'wait' verb is specific, but the description lacks explicit resource context beyond the run-related name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions a polling requirement ('mustCallAgain=true') but does not state when to choose this over get_run or other siblings, nor any exclusions. This leaves the selection decision to the agent without support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.0- First observed
authorize_workspace - First observed
cancel_run - First observed
doctor - First observed
get_run - First observed
list_models - First observed
list_runs - First observed
read_events - First observed
reply_run - First observed
start_run - First observed
wait_run
TDQS
Scored across 10 tools
Each tool targets a distinct aspect of the run lifecycle: authorization, starting/reply runs, querying state, waiting, cancelling, listing, reading events, checking config, and discovering models. Even the similar start_run and reply_run are clearly separated by their purpose and description.
Most tools follow a clear verb_noun pattern (authorize_workspace, start_run, cancel_run, list_runs, read_events, list_models). 'doctor' breaks the pattern, but it's a single minor deviation; the overall style is consistent.
Ten tools is appropriate for a run-relay server; each tool has a clear role and the set covers the core workflow without unnecessary bloat.
The tools cover the full run lifecycle: create/reply (start_run, reply_run), read (get_run, list_runs, read_events), wait/cancel, plus prerequisite discovery (list_models) and diagnostics (doctor). The only minor gap is that events have a quantity limit with no pagination tool, but that's a practical constraint.
Maintenance
Related MCP Connectors
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Reliable async execution for agent tool calls: schema gating, retries, idempotency, audit trail.
Hosted TikTok ads MCP with OAuth, bounded reads, and prepare/confirm writes.
Hosted MCP memory and agent control plane for durable conversations, jobs, and operations.
Related MCP Servers
- FlicenseAqualityCmaintenanceEnables MCP clients to invoke Cursor SDK's agent runtime, run coding agents, list models, and continue conversations.4-
- AlicenseDqualityCmaintenanceProvides MCP tools and hooks for agent coordination within Cursor workspaces, enabling claim-based scope management, compliance auditing, and production readiness checks.4MIT
- AlicenseAqualityCmaintenanceEnables agents to submit and manage persistent, dependency-aware task graphs with immutable artifacts, resource reservations, durable event streaming, and retryable process execution over MCP.12MIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to run declarative agents and DAG workflows as plain tools, with parallel nodes, review loops, and per-run least-privilege sandboxing.13 npmMIT