Cursor can now take an app from a description to a live link. According to Cursor’s changelog, you start a cloud agent (an agent that runs on Cursor’s servers instead of your computer) and tell it you want an app. It builds the web app, adds a Postgres database if one is needed, sets up login through Cursor sign-in, and arranges hosting. When you publish, you pick a unique domain and get a link.
The feature is available on all paid plans with cloud agents enabled. Cursor describes teammates in sales, operations, legal and finance building internal tools this way, such as event registration, account assignment and sales dashboards.
Who can open the app, and what gets checked
Apps sit behind Cursor sign-in. You can share one with specific people, groups or your whole team. On individual plans, an app can also be made public.
If an app needs to reach your systems, such as a data warehouse, the agent asks you for the secrets (passwords and access keys) it needs. Before publishing, Cursor runs automated security reviews for common problems like secrets written into app files or exposed credentials. A publish is blocked until the checks pass and the publish is approved.
Team admins can see every app and secret on the team. They can add their own rules to the security review, approve a publish the review blocked, and unpublish any app.
The person who describes the app decides what it connects to
Hosting, login and a database used to be separate jobs, which is often why a tool someone built with an agent stayed on their own machine. Here the agent handles them as part of the build. So the person describing the app is also choosing which data it can reach.
Admins should look at which secrets people are handing to these apps and whether their custom security rules fit their data. Builders should give an app only the access it needs. Cursor can also issue an API key so a script or a Grok bot can use your app, and that key deserves the same care as any password.
End of article