How Cursor reaches tools today
Cursor’s agent calls tools over the Model Context Protocol. Its documentation describes tool servers declared per project or for every project on a developer’s machine, running locally as a command or remotely over the network, with credentials supplied alongside them and values pulled in from the developer’s environment.
For enterprises, Cursor documents further controls: an allowlist that approves servers by pattern, with optional restrictions on which of a server’s tools may be used, network controls that allow every destination, allowlist a set of them or deny all, a switch for whether developers may add servers of their own, and a way to distribute approved servers to a team from the dashboard.
Those controls answer which servers Cursor may connect to. They do not answer, per developer and per action, what those servers may then reach, and they leave the record of what the agent did on the developer’s machine.
What a team gets to decide
With KPATH on the path the agent’s tool calls travel, the reach of a Cursor session becomes a team decision rather than a per-machine one.
- Which developer is acting. Every governed call carries the developer’s identity, with an owner and a risk tier behind it. Your identity provider decides who exists. KPATH enforces at the moment the agent acts.
- What that developer may reach. Which tools, which repositories, which internal systems, which web destinations, written per developer and per team. The decision is made on each call, not once at onboarding.
- What it may spend. Budget is checked on the call itself and attributed back to the developer and the originating request.
- When a person has to agree. Policy can require a human to approve before a high-risk action proceeds.
- What stops. An agent, or a whole chain of agents one request set off, can be stopped and stays stopped.
Because every approved tool sits behind one governed endpoint, a developer never holds a credential for a tool server. KPATH adds the real credential on an allowed call. A laptop that goes missing holds nothing that opens a door anywhere else.
What gets recorded
Every call, allowed or refused, lands in a signed, tamper-evident record: who acted, which tool, which target, what was decided and why. It streams to your SIEM and is ready for write-once retention. It holds no secret, no prompt and no message body, and an auditor can verify it has not been altered without trusting KPATH.
KPATH governs the request envelope: identity, target, action, size, delegation chain. Of the payload, it reads only the values you declare for a rule, such as a payment amount.
What changes for the developer
Very little. Cursor still runs, the model is the same, the prompts are the same. The difference is that the agent’s tool calls travel through one endpoint the team governs, and the record of what the agent reached exists somewhere other than the laptop.
Deploy in monitor mode: observe only, enforce no policy, rewrite no agents. Flip to enforce by repointing egress, once the team has seen what its agents actually call.