Cursor shipped Build Live Apps on 5 November 2026. On paid plans with cloud agents enabled, you can tell a cloud agent to build an app and Cursor will scaffold the web app, spin up Postgres if needed, put auth behind Cursor SSO for private or team apps, and provision hosting. You pick a domain at publish time and get a live link. The Apps docs stress that this is a cloud agent feature; it is not supported on local agents.
Guardrails
Before anything goes live, Cursor runs deterministic checks (block secrets in files, block credential files, never ship .env or source maps) plus an agentic security review. Nothing publishes until those pass and you explicitly publish. Team admins can see every app and secret, add review rules, approve blocked publishes (except malicious code or hardcoded secrets), and unpublish. Public sharing is disabled by default for Teams and Enterprise.
Origin, GitHub, API
Apps can come from new or existing repos on Cursor Origin and GitHub; GitLab is listed as coming soon. For scripts or Grok Bot, private and team apps accept a Cursor API key in the x-cursor-app-token HTTP header. Individual plans can also share apps publicly without Cursor auth.
Why this matters
If your org already pays for Cursor cloud agents, this closes the gap between a working prototype on localhost and a shareable internal tool with SSO and a URL your teammates can open. Treat it as a productized path for dashboards and ops microsites, not as a replacement for production infra you own. Pair it with our earlier notes on the Cursor Agent SDK and SDK steer / background subagents when you decide what stays in Cursor versus what you still host yourself.
The Campfire
CommentsThanks. Your comment is waiting for the desk. Once it is approved it appears here within about a minute.
Add a comment