1 min lesson
Hooks: the deterministic guardrail layer
Use "Hooks are the one primitive that is not probabilistic" to describe the practical rule.
Step 1 of 3
Hooks: the deterministic guardrail layerthe enterprise differentiator
Hooks are the one primitive that is not probabilistic: they are actual code that executes in the shell at lifecycle trigger points across the IDE and the CLI - roughly a dozen of them. They originated from enterprise customers' bespoke requirements (Cursor was perpetually catching up building everyone's features, so hooks let any user extend Cursor themselves), they are shareable across the team and agent types, and they also run in cloud agents.
Learn more
Advanced table
Truly deterministic
- Trigger point
- Prompt submit
- Fires when
- Before a prompt reaches the model
- Canonical use
- Scan for PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. / API keys / secrets and halt the prompt, returning a custom error.
- Trigger point
- Agent reads a file
- Fires when
- The agent opens a file
- Canonical use
- Audit or block access to sensitive paths.
- Trigger point
- Agent writes a file
- Fires when
- Before/after an edit
- Canonical use
- Enforce "no private keys" before any change lands.
- Trigger point
- MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool call
- Fires when
- An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool is invoked
- Canonical use
- Gate or log external tool access.
- Trigger point
- Terminal tool call
- Fires when
- A shell command runs
- Canonical use
- Block or record dangerous commands.
- Trigger point
- Stop hook
- Fires when
- An agent run finishes
- Canonical use
- Log every prompt to a database; mine the run for durable facts.
| Trigger point | Fires when | Canonical use |
|---|---|---|
| Prompt submit | Before a prompt reaches the model | Scan for PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. / API keys / secrets and halt the prompt, returning a custom error. |
| Agent reads a file | The agent opens a file | Audit or block access to sensitive paths. |
| Agent writes a file | Before/after an edit | Enforce "no private keys" before any change lands. |
| MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool call | An MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool is invoked | Gate or log external tool access. |
| Terminal tool call | A shell command runs | Block or record dangerous commands. |
| Stop hook | An agent run finishes | Log every prompt to a database; mine the run for durable facts. |
Truly deterministic: a prompt-submit hook that finds a secret halts before the model ever sees it. This DLP/compliance layer is what regulated enterprises buy.
The canonical real skill to cite is Cursor's internal de-slop skill/command, published on the public marketplace. It evaluates model-written code and strips typical AI slop - generic variable and function names, verbose comments, overengineering and unnecessary abstraction, bad boilerplate - and standardizes style. Cursor's own engineers run it consistently at generation time, before code reaches a PR. It is the concrete example that makes "skills" land, and it ties straight to the broader theme that code quality and review, not generation, is the new bottleneck.
The first MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server a developer builds usually fails on auth or transport, not logic. Secrets that aren't passed through env, a server that exits immediately or a command path the agent can't resolve. Build at least one integration yourself so you can document these setup pitfalls credibly instead of waving at "check your configuration."
If they hand you a vague "connect the agent to our database" task, narrate the decision: MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server for the live connection, a rule for the query conventions and a skill if there's a repeatable migration procedure. Choosing among the three out loud is exactly the teachable judgment the role is graded on.
Learn more
Optional practice
Practice: Hooks: the deterministic guardrail layer
QA team wants their agent to (1) query their production read replica, (2) always use their internal logging helper and (3) know their standard data-migration steps. Map each need to the right extension primitive.