Cursor Enterprise: Model & Integration Management (Allowlists, MCP)

Model access control is an Enterprise feature. Admins set the team baseline under Team Settings → Models in the dashboard:

• Turn models on or off under Cursor ModelsOn legacy Cursor plans, the monthly usage pool for Cursor's own models (Grok 4.7, Grok 4.6, Grok 4.5 and Composer 2.5), kept separate from the third-party Other Models pool. The X Subscription replaces it with one weekly pool. Press Enter for the full definition. and Other ModelsOn legacy Cursor plans, the monthly pool for supported third-party models from providers such as Anthropic, Google and OpenAI, separate from Cursor Models. On The X Subscription third-party models are billed from prepaid credit instead. Press Enter for the full definition..
• Set defaults for new providers and models under Model Defaults.
• Allow or block members' own keys under Personal API Keys (BYOK).
• Since a May 2026 update, block an entire provider, or a specific model configuration by speed and context window size.

Cursor doesn't enable new models for every Enterprise team right away. Its docs say Enterprise teams can opt in to new models for their organization, and the May 2026 changelog describes an option to block new providers or model versions by default.

Blocking new models by default creates an approval queue. When a model ships, nobody can select it until an admin turns it on, and members may report the gap as a broken model picker. Decide who reviews new models before you turn that default on.

Organization Groups can widen access for a cohort. Team and group settings combine as a union: a model is allowed if the team or any of the person's groups allows it. Put the strictest defaults on the team, and use groups only to add models.

When someone reports a missing model, check for a provider block first, because it hides every model from that provider at once. If the model is new, check whether your team has opted in to it yet.

Enterprise teams can use Cursor's own models, including Grok and ComposerCursor's own fast coding model, tuned for the editor and priced well below frontier models; the recommended day-to-day model for executing a plan. Press Enter for the full definition., and third-party models from OpenAI, Anthropic, Google and other providers. On Enterprise, third-party models bill at API list price, plus the Cursor Token Rate on eligible models. The list changes as providers release new versions, so read the current set on the Models page before you write it into a policy.

A bring-your-own API key routes model calls through your own provider account. Cursor's BYOK help page lists five providers, including two cloud platforms, Azure OpenAI and AWS Bedrock.

Three Cursor features run on models your model settings can block. Check them before you block a whole provider. Blocking Anthropic, for example, also blocks Claude 4.5 Haiku, which Cursor says to keep allowed for Auto-review.

Look for these failures outside the model picker. Auto-review appears grayed out under Approvals & Execution, a BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. check finishes as neutral, and Cursor Router can stop working. Test all three after you change the model list.

With your own key, the provider bills you directly for the model cost, and Cursor still sends every request through its servers to build the final prompt. Reasons to use your own keys include:

• An existing enterprise agreement with a model provider.
• A need for specific rate limits or data residency terms from the provider.
• A finance team that wants model costs on a single provider invoice.

Blocking a provider and restricting personal API keys are separate settings, and the first doesn't stand in for the second.

Cursor's hardening checklist puts both in one step and says to restrict personal keys if you rely on Cursor's zero data retention (ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition.) agreements. Cursor's BYOK help page says its ZDR policy doesn't apply to requests made with your own key. The BAA page covers retention in more detail.

Enterprise admins control which MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers members can use, from MCP Configuration in the team dashboard. MCP servers are the integrations that let agents read external systems, call APIs and act on your behalf. Once an allowlist is active, only servers that match an entry can run, and the rest are blocked.

1. 1Open MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. Configuration in the team dashboard.
2. 2Add each approved server as an entry: its full command string for a local server, or its URL for a remote one. Entries accept wildcards, so one entry can match a command at any install path.
3. 3Set each server's tool controls and network policy.
4. 4To distribute an approved server, add it to a team marketplace. The allowlist alone doesn't put a server on anyone's machine.

MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers come from outside vendors, not from Cursor, so review what each one can read and do before you approve it. .cursorignore doesn't help here. MCP tools can't honor it, so an approved server with file system or database access can return content you excluded from agent reads.

Yes, server by server. In MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. Configuration, each approved server has a Tools field: list the tools that may run, or leave it empty to allow all of them. Each server also has its own network policy. A remote server is held to its configured URL pattern. A local server gets one of four network modes: Allow all, Allowlist, Deny all, or No sandbox, which runs it without command or network sandboxing.

Which tools run without review is a separate list. The mcpAllowlist in ~/.cursor/permissions.json names tools in server:tool form, and you can distribute that file through MDM. Admin settings in the dashboard outrank the file, the file outranks editor settings, and a higher source replaces a lower one instead of merging with it.

An internal CI server can expose many tools, and only a few of them change anything. In the example, the agent reads pipelines and logs without stopping. How a trigger_deploy call is held back depends on the run mode. In Allowlist mode it waits for a person to approve it. In Auto-review, the classifier judges it first and can still let it run.

A pluginA Cursor marketplace package that bundles MCP servers and skills (sometimes sub-agents and hooks); one click installs all of it into your Cursor instance. Press Enter for the full definition. packages rules, skills, agents, commands, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers and hooks into one installable bundle. Instead of asking every engineer to set up the same integrations by hand, you ship one plugin and the team gets the same setup. That makes a plugin a unit of governance too, because approving one approves everything inside it.

Plugins come from marketplaces. The Cursor Marketplace lists official plugins, and Cursor reviews each one by hand before listing it. Team marketplaces hold your organization's own plugins. They are on Teams, which gets one imported marketplace plus the Default marketplace, and on Enterprise, which gets unlimited marketplaces that only admins can add. The marketplace and plugins page covers the manifest and the install side.

Team RulesRules promoted to apply across a whole organisation and shared consistently between the Cursor IDE, Agent and Bugbot. Press Enter for the full definition. are rules an admin creates in the Cursor dashboard, on Teams and Enterprise plans, and they apply to every team member. An admin can turn on Enforce this rule to make a rule required, so members can't switch it off in Customize. Rules that aren't enforced can be switched off by each member.

When guidance conflicts, Team RulesRules promoted to apply across a whole organisation and shared consistently between the Cursor IDE, Agent and Bugbot. Press Enter for the full definition. come first, then project rules, then user rules. A glob pattern can limit a team rule to matching files in context. For example, a team rule can tell agents to query only approved Databricks tables. A rule steers the model rather than binding it, so pair it with an enforcement hook when the table list is a control you would show an auditor.

Several dashboard settings set a team-wide baseline for agents. On Enterprise, admins set the run-mode policy, which decides the modes members can pick. On Teams and Enterprise, the Cursor Router setting Impose Auto makes Auto the default model. Soft defaults each new chat to Auto, and Hard locks the model picker to Auto.

Two repository controls answer different questions. The Repository Blocklist (Enterprise) makes Cursor refuse to index or work with matching repositories, in the editor and CLI only, not in Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition., automations or BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition.. Protected Git Scopes (Teams and Enterprise) decides who may use your repositories with those three. It locks a Git organization, group or namespace to your Cursor organization, so outside Cursor accounts can't reach its repositories there, even accounts with legitimate Git access.

Claiming a scope takes a Cursor team admin who is also an admin on the Git provider. It works with cloud and self-hosted GitHub and GitLab, and you manage it from the Integrations tab of the dashboard.

Both come after the runtime controls in Cursor's admin quickstart, the checklist at the top of its hardening page. It starts with enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition., the Run Mode policy, distributed hooks, network allowlisting and a rules baseline. Plugin and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. governance comes next. The model allowlist and the personal-API-key decision come later still, after identity and extension controls.

The model allowlist answers a procurement question: which vendor sees the code, and what the tokens cost. It says nothing about what an agent does once a developer starts one, which is what run modes and hooks control. MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool limits do bound what an agent can do, but only for tools it reaches through a server. A shell command that does the same damage is still a run-mode question.

Reverse the order and you can spend the review cycle agreeing on a model list while any developer can still switch to Run Everything, with nothing in the path to stop a command.

Part of the model decision is made for you anyway, because Cursor's hardening page says non-ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. models require admin approval. Team size moves the MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. half more, and that is the part we'd revisit as the org grows. On a ten-person team, you can read the server inventory by name. The allowlist starts to matter at the size where nobody can list every server in use.