Cursor

There are two ways to use Pushary with Cursor. The plugin is recommended.

Plugin (recommended): enforced approvals

Run setup and choose Cursor:

npx @pushary/agent-hooks@latest setup

This does two things: it installs the plugin to ~/.cursor/plugins/local/pushary (MCP tools, the always-on rule, and the skill), and it registers an enforced beforeShellExecution gate in ~/.cursor/hooks.json. The user-level ~/.cursor/hooks.json is the reliable place for the gate, and running setup is what puts it there. Setup also strips the gate from the plugin copy, because some Cursor versions run a local plugin's bundled hook too, which would otherwise fire the approval twice.

Before Cursor runs a shell command that matches a risky pattern (such as rm, --force, reset --hard, drop, or deploy), the gate pauses and routes the command through your permission policy. You approve or deny from your phone, and the command runs only after you say yes. If the check cannot complete, the command is blocked, not allowed.

This is enforced, not cooperative. The agent does not get to choose whether to ask. Cursor makes the command go through approval.

After setup, fully quit and reopen Cursor to load the gate. A Developer: Reload Window is not always enough.

Plain MCP: cooperative tools only

If you cannot install the plugin, add Pushary as an MCP server. During onboarding, click the Add to Cursor button, or add this to your .cursor/mcp.json:

{
  "mcpServers": {
    "pushary": {
      "url": "https://pushary.com/api/mcp/mcp",
      "headers": {
        "Authorization": "Bearer pk_xxx.xxx"
      }
    }
  }
}

Replace pk_xxx.xxx with your actual API key. This gives your agent the notification and question tools, so it can ping your phone and wait for an answer. But nothing is intercepted: the agent must choose to call the tools. If it never asks, you are never asked, even right before a dangerous command.

Plugin vs MCP at a glance

The plugin is a strict superset: it bundles the same MCP tools and adds the gate.

Honest limits

• The gate is shell only. Cursor only exposes a hook for shell execution, so file reads and edits are not gated.
• The gate only fires on commands that match its risky-pattern list.
• The gate must be registered in ~/.cursor/hooks.json. Setup writes it there for you on version 0.18.3 or later. If the gate never fires, run npx @pushary/agent-hooks@latest doctor, which checks that the hook is registered and that its script path resolves, then fully quit and reopen Cursor.
• On Windows, Cursor sends the hook a BOM-prefixed payload, which older gate versions could not parse (they fell back to Cursor's own prompt with no push). Version 0.18.3 or later parses it correctly. If you patched the gate by hand, re-run setup to pick up the shipped fix.
• If Cursor still cannot pass the command to the hook over stdin (a separate, rarer Cursor issue), the gate falls back to Cursor's own prompt, so it never silently allows. The cooperative MCP tools still work because the agent can call them directly. Cursor's hooks output channel shows what the hook received.

Install the skill

The plugin already includes the skill. If you connected via plain MCP only, install it so your agent knows when to notify you:

npx skills add Pushary/pushary-skill