Cursor has no dangerously
skip permissions flag.
Cursor has no --dangerously-skip-permissions; that flag belongs to Claude Code. In the Cursor Agent CLI the bypass is agent --force (aliased --yolo), which force-allows every command unless it is explicitly denied, typically alongside -p/--print and --trust for headless runs. The CLI's command is agent; the older cursor-agent name still works as a legacy alias. The catch is that Cursor's denylist has documented bypasses, so --force effectively means unsupervised shell access. The safer pattern is to keep a human gate on non-allowlisted commands with Pushary, pushing those approvals to your phone and keeping an audit trail.
Updated
The flag
agent --force (alias --yolo)Force-allows every command unless it is explicitly denied.
Featured on Hacker NewsWhat the flag actually does
The --force flag (aliased --yolo) tells the Cursor Agent CLI to force allow every command unless it is explicitly on the deny list, so the agent runs terminal commands and edits with no confirmation prompt. In headless and scripted use it is usually paired with -p/--print (non-interactive output, full tool access including write and shell), --approve-mcps (auto-approve all MCP servers), and --trust (trust the workspace without prompting in headless mode). Together these give a fully unattended agent that executes on its own.
Cursor keeps asking for permission: check these first
First identify the surface: Cursor Agent CLI and the Cursor editor have different settings. Changing a CLI configuration file does not establish the editor's approval behavior.
For the CLI, inspect ~/.cursor/cli-config.json and the project's .cursor/cli.json. Check permissions.allow and permissions.deny against the exact command or file being requested. Deny rules take precedence. Shell(git) covers any git subcommand, so use a narrower command:args pattern when you only intend to allow a specific operation.
Workspace trust, MCP server approval and permission to run a command are separate checks. --trust and --approve-mcps do not mean you approved every future shell action. In the editor, inspect the current Auto-Run settings and any team restrictions on the actual request.
If you want to leave the desk while retaining a decision on risky commands, use the supported Pushary Cursor hooks. If a request is missing or stale, check Cursor's session first; another notification channel cannot repair its host UI.
Why people use it, and the real risk
Cursor's deny list is the only thing standing between --force and disaster, and security researchers at Backslash showed the denylist is bypassable, including through Base64-obfuscated commands, so 'explicitly denied' is not a reliable fence. In this mode the agent runs shell commands and file edits with no human check, so a destructive command or a prompt-injection payload hidden in a repo file or fetched web page executes immediately. Because MCP servers are auto-approved with --approve-mcps, a malicious or compromised server also runs unattended. There is no per-command approval record, so you cannot later show which actions a human sanctioned.
Three ways to run an agent
Full bypass keeps the agent moving but drops the gate. Babysitting keeps the gate but pins you to the keyboard. A phone gate keeps both.
| Approach | Agent keeps moving | Destructive actions gated | Away from the keyboard | Audit trail |
|---|---|---|---|---|
| Full bypass (Cursor) | ||||
| Babysit the terminal | ||||
| Pushary phone gate |
The safer alternative
Keep permissions scoped to the commands and files you intend to allow. The Pushary Cursor plugin can hold supported shell commands for your phone approval through Cursor hooks. Plain MCP gives the agent tools for questions and notifications; it does not enforce a gate. Neither path overrides a Cursor denial or guarantees coverage of every editor action. Check the integration guide before relying on an approval boundary.
Cursor skip permissions questions
Does Cursor have --dangerously-skip-permissions?
No. It is a Claude Code flag. The Cursor equivalent is agent --force in the Cursor Agent CLI, aliased --yolo, which force-allows every command unless it is explicitly denied. Headless runs usually pair it with -p/--print, --trust to skip the workspace trust prompt, and --approve-mcps to auto-approve MCP servers. The difference that matters is that Claude Code's flag removes an allowlist check while Cursor's leans on a denylist, and Cursor's denylist has documented bypasses, so --force is the broader of the two.
How do I enable YOLO mode in Cursor CLI?
In the Cursor Agent CLI, whose command is agent (formerly cursor-agent), the flag is --force (its alias is --yolo), described in Cursor's docs as force allow commands unless explicitly denied. For headless automation you usually add -p/--print for non-interactive output and --trust to skip the workspace trust prompt, and --approve-mcps to auto-approve MCP servers. Because Cursor's denylist has known bypasses, a safer route is to allowlist safe commands and push everything else to your phone with Pushary.
How do I make Cursor agent auto-run terminal commands without asking?
Passing --force makes the Cursor Agent CLI auto-run commands that are not on the deny list, and in the editor this is the Auto-Run / YOLO setting. Be aware researchers demonstrated the denylist can be evaded with obfuscated commands, so it is not a strong guardrail. Keep a human in the loop on risky commands with a Pushary policy that sends the approval to your phone and logs the decision.
Is Cursor --force safe to run unattended?
Only inside an isolated sandbox or disposable container, never against a repo with live credentials or production access, because --force plus the bypassable denylist means the agent can run destructive or injected commands with no human check. For real work, keep an allowlist for safe commands and gate the rest through Pushary so approvals hit your phone and stay in an audit trail.
Run Cursor unattended without skipping every permission.
Keep the agent moving, gate the risky calls, approve from your phone. Set up in two minutes.
Start your trial$9.99/mo after a 3-day free trial. Cancel anytime.