Auto Review Run Mode is "buggy" when it comes to multiple mcp calls at once

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I’m seeing inconsistent behavior when using permissions in permissions.json.

For example, let’s say I want an agent to update a large number of Jira tickets, and updating those tickets is the intended task after implementing code first. However, in my permissions.json, I have a block rule that requires confirmation whenever the agent wants to modify, edit, or create anything in Jira.

In this scenario, I’ve observed that sometimes one out of five Jira updates is executed successfully, while the remaining four require confirmation. This happens even though all actions appear to be of the same type and should be evaluated consistently.

I understand that the system is not fully deterministic, but it feels like the evaluation layer may either be making incorrect decisions or applying the permission rules too aggressively.

I also have a few questions regarding best practices for permissions.json:

  • Are there any recommended limits for the number of allow/block instructions?

  • Is there a recommended file size, character count, or line count?

  • When evaluating permissions, does the model consider:

    • the current command only,
    • the command plus the chat history,
    • or the command, chat history, and the entire permissions.json file?

  • How does the system determine the user’s intent?

  • What is the recommended approach for writing permission rules?

    • Should permissions be highly specific and detailed?
    • Or is it better to keep them broad and concise?

For context, my current permissions.json has the following characteristics:

Metric Value
File size 7.3 KB (7,492 bytes)
Lines 34
Words 974
Characters 7,492 (including whitespace and line breaks)
Structure 1 top-level key: autoRun
Allow instructions 10 entries
Block instructions 16 entries
Total rules 26 entries

Based on your experience, does this configuration look reasonable, or could the size and complexity of the file be contributing to the inconsistent permission evaluation behavior?

Steps to Reproduce

Create a similar sized permissions.json and ask the agent to implement code and update jira after.

Expected Behavior

it asks every time it modifies something.

Screenshots / Screen Recordings

Bildschirmfoto 2026-06-24 um 10.43.02.png
Bildschirmfoto 2026-06-24 um 10.43.02.png1347×252 11.7 KB

Operating System

MacOS

Version Information

Version: 3.8.23
VS Code Extension API: 1.105.1
Commit: 7cf19b7482706625cdb70db3211b7dd035b7aa30
Date: 2026-06-23T14:57:42.334Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Darwin arm64 25.5.0

For AI issues: which model did you use?

GPT-5.5 1M Extra High

Does this stop you from using Cursor

No - Cursor works, but with this issue

7

Hi @NZ_Bayard , first of all I really appreciate the detailed ticket. This is very helpful.

You are right that this is not fully deterministic, and I believe it is being made worse by the fact that your permissions.json is too large. You have 16 block instructions, we don’t recommend having more than 5 (ideally less than 10 total across allow and block). Models don’t do particularly well with too many instructions! Maybe in the future that’ll change but for now we have to use very small models for Auto-review which are not as intelligent as the larger models, so it’s particularly important you keep the list small.