Cursor's Agent SDK is out: the framework behind Bugbot, now for your own agents

Disclosure: Grok Bot, our desk-bot, runs on Cursor.

Cursor has released the Agent SDK, which it describes in its announcement as “the framework we use to build our own managed agents like Bugbot, Security Reviewer, and Rollouts”. The docs changelog lists version 0.3.0 on 23 October as the general-availability release, and Cursor promoted it on X on 26 October. This is a different product from the Cursor SDK we covered earlier, which runs Cursor’s own agent from your code. The Agent SDK is for defining your own agents.

What you write

An agent is a project folder. Each file is something the agent knows or can do: prompts are Markdown files and tools are TypeScript functions, so changes go through version control and code review like the rest of your software. Agents can hand a task to another agent with its own tools and sessions, or split a job among subagents working in parallel. Evals and event replay are built in.

Cursor’s examples: an internal team built an agent that checks every pull request against a knowledge base of past lessons “in about a day”, and the PGA Tour uses the SDK for what it calls its software development factory.

Running it

• Install. The docs say to check for Node 22.13 or newer and run npm install --global @grok/agent-sdk. Note the package name: the blog’s sample code imports @cursor/agent-sdk, but on 27 October the npm registry had no package by that name, while @grok/agent-sdk was at 0.3.0. The docs say it was formerly @cursor/bdk.
• Hosted. agent-sdk deploy runs the agent on Cursor’s infrastructure.
• Self-hosted. One Node process, which can go in a container, via agent-sdk serve. It still needs a CURSOR_API_KEY. The docs say to keep --bearer-token on unless a proxy authenticates every caller, put TLS or an authenticating proxy in front, and keep --state-root on a backed-up persistent volume. Node only: “never Bun”.

The fine print

• Not open source. The package’s licence file reads “Cursor SDK License”, all rights reserved, with use subject to Cursor’s Terms of Service.
• Privacy Mode (Legacy) blocks it. Under the current Privacy Mode, deploys work and model requests get the usual Privacy Mode handling. Under Privacy Mode (Legacy), deploy, hosted sessions and eval runs all refuse. Teams that enforce the legacy mode need an admin to switch.
• Evals touch real tools. The evals guide warns that evals run real tools, and shows how to check a session’s purpose: "eval" flag before a tool writes anything.
• Pricing. We found no price for hosted runs on the pages above.

Also from Cursor this week

Cursor said on X that DeepSeek V4.1 Flash (our launch story) is now available in Cursor, citing a cost of $0.60 to $0.98 per task on CursorBench, Cursor’s own benchmark.