Cursor

defenseclaw setup cursor

Confirms once, wires the hooks against ~/.cursor/hooks.json, and restarts the gateway. Findings flow to mandatory SQLite event history and the TUI; configured v8 destinations receive only the buckets/signals their routes select. No traffic is intercepted and no requests are blocked. Pass --yes to skip the confirmation in CI.

defenseclaw setup cursor --yes --with-local-stack

Same as standard but also runs setup local-observability up so Prom/Loki/Tempo/Grafana come up locally for ad-hoc dashboards. That command writes the export destination after the alias has already restarted the gateway, so run its printed defenseclaw-gateway restart step before expecting exports. See Local observability.

export DEFENSECLAW_LLM_KEY='replace-with-your-key'

defenseclaw setup cursor                                  # base alias first
defenseclaw setup guardrail \
  --connector cursor \
  --rule-pack strict \
  --scanner-mode local \
  --detection-strategy regex_judge \
  --judge-model anthropic/claude-sonnet-4-20250514 \
  --judge-api-key-env DEFENSECLAW_LLM_KEY \
  --judge-hook-connectors cursor \
  --restart

The alias selects Cursor; the follow-up setup guardrail --connector cursor swaps in the strict rule pack, keeps scanning local, and turns the LLM judge on as a second-pass adjudicator on regex-flagged events. Configure the remote scanner separately through full guardrail setup, which validates its endpoint and API-key environment variable.

Cursor has no proxy enforcement, but its hooks can enforce directly:

defenseclaw setup cursor --mode action --human-approval --fail-mode closed

With mode=action, beforeShellExecution and beforeMCPExecution surface a native ask when policy returns an eligible confirmation verdict. The other block events use an alert/context fallback with raw_action preserved; the TUI can review but not resume them.