#57 feat(agents): Cursor CLI reaches the browser — each turn approves its own MCP server, approvals outlast its 60-second calls, and results fit what it passes on

[Anonymous]

Originally created by: imshaikot

Part of [#56]. Cursor stays in beta until a real side-panel conversation has been through it (see Not verified).

Why

Cursor CLI has been a side-panel agent since [#25], in beta. Its only recorded turn was "hello from cursor"; it had never made a tool call through Browsentic. To bring it up to Claude Code, I measured it first: six real turns against cursor-agent 2026.09.18-9a7762b. Each ran the runner's own plan through drive.ts, with a stand-in MCP server in place of browsentic mcp. The full results are on [#56].

The first turn found a bug in what has already shipped. A Cursor run has never had the browser tools. Cursor starts an MCP server from a project's .cursor/mcp.json only once that server is approved (cursor-agent mcp list reports not loaded (needs approval)), and nothing approved ours. The model searched, grepped and tried the shell until Cursor stopped it with Agent Looping Detected.

The turns that followed found the rest:

• Tool lookup: Cursor hands the model a tool's schema only when it asks with GetMcpTools.
• 60-second calls: Cursor abandons any tool call at exactly 60.0 s. That is the MCP SDK's default timeout, which it never overrides.
• 40,000-byte results: longer text goes to ~/.cursor/projects/<folder>/agent-tools/<uuid>.txt, and the model gets only the path, which the run cannot read.
• Follow-up turns: a resumed turn answers from the AGENTS.md its session began with.
• Plugin servers: every Cursor plugin's MCP server loads in every run.
• Reader: our own calls were drawn twice on the timeline, and the token count covered the whole turn.

What changes

Cursor runs reach the browser

• Approval before each turn. A runner's Plan can now carry prepare: commands of the same CLI, run in the run's folder through spawnCli once its files are written and before the turn. vetPlan allows exactly the set-up commands CONTAINMENT names. For Cursor that is cursor-agent mcp enable browsentic, for a run and never a task. An approval covers the server's exact config, which names the run, so each turn approves its own; it took 0.26–0.35 s. --approve-mcps, which approves every server the user has, stays forbidden.
• Plugin servers denied. Every plugin's MCP server is denied as Mcp(plugin-*:*), beside the user's own servers by name. If any server but browsentic answers a call, the run stops with AGENT_UNSAFE.
• Prompt section. A new section at the end of AGENTS.md tells the model to look up the browser tools it needs in one step.
• Runner flags. keepsFirstPrompt: true, and opens: text, pdf, image; a one-shot read a PNG and a PDF correctly.
• Reader fixes. Our calls are recognized by providerIdentifier, schema lookups are left off the timeline, Cursor's own tools get a toolResult, and usage summed over the turn is no longer reported.

Every runner can declare limits: { callMs, resultBytes }, and only Cursor declares any (60,000 ms and 40,000 bytes).

• Approvals. When an approval is still unanswered 10 s before the limit, the call returns APPROVAL_PENDING and the card stays up. The same call with the same input rejoins the card, with no second row. Any other call, the run ending, or Stop withdraws it, and a late answer does nothing.
• Waits inside a call (awaitMonitor, pickElement, solveCaptcha, captureDownload, and any timeoutMs on runCode, callSiteTool or waitForElement) are cut to what is left of the call.
• Result size. The run's MCP server gets BROWSENTIC_RESULT_BYTES. It refuses a longer result with RESULT_TOO_LARGE instead of cutting it, and says the call itself went through. It also asks page_extractText for groups of a quarter of the limit in characters.

On every agent, a call its client abandons withdraws its approval. The MCP server passes the request's cancel signal to the bridge, which sends a new control op { op: 'cancel', id }. The daemon aborts that invoke, and a tool server whose socket closes aborts everything it had in flight. Until now, a late Allow ran the action after the model had moved on. Old daemons ignore the new op.

Three new recordings: fixtures/cursor/2026.09.18-mcp-calls, -resumed and -mcp-timeout.

Verified

• Real CLI after the change. I ran the new plan against the real CLI in a conversation folder that had never been approved. The server started, all four stand-in tools answered, and the model looked them up in one parallel step as the prompt asks. The timeline showed only Cursor's own tools, each closed.
• New tests:
• spawn.test.ts: the set-up step is allowed, and every other step, a task, or another agent is refused; the plugin deny is required.
• drive.test.ts: the step runs in the folder before the turn, and a failing step stops the turn with what it printed.
• service.test.ts: parking, rejoining, withdrawing on another call, on Stop and on cancel; no parking without limits; waits cut to fit.
• server.test.ts: the size guard counts UTF-8 bytes and ignores pictures; reads are narrowed; cancel reaches the bridge.
• remote-bridge.test.ts and cursor.test.ts: the cancel op, and the new recordings.
• Full suite. vitest run passed 2030/2030. yarn check passed both type checks and every coverage floor; the daemon is at 78.0% against a 61% floor.

Not verified

• No real side-panel conversation on Cursor yet. That means a real page, an approval left past a minute, an A-Eye pick on a follow-up, Stop, and a daemon restart. It needs this build installed in place of the app. Cursor keeps its beta label until it has passed.
• The size guard has not met Cursor. It was tested in the MCP server only; the real-CLI turns used the stand-in server, which has no guard.
• yarn check timeouts. Its coverage run pushed this machine's load average past 80 and timed out 1–6 tests per run, a different set each time (self-update, preferences, socket, index readiness, the profile and follow-up prompt tests in service.test.ts). Every one passed when run alone, and vitest run without coverage was all green.

Follow-ups

• Run the side-panel conversation, then drop beta from Cursor's catalog entry and the README.
• Mistral Vibe (60 s, measured) and Grok Build (results cut at 20 KB) could each declare limits in one line.

🤖 Generated with Claude Code

[Anonymous]

Ticket changed by: imshaikot

• status: open --> closed