Does Cursor CLI respect all Cursor IDE settings ('Privacy Mode Legacy' etc) and stay in single repo?

Support Help
, ,
1

I am on Windows 11 and just installed Cursor CLI via:

irm 'https://cursor.com/install?win32=true' | iex

per the docs at https://cursor.com/docs/cli/overview.

Before I run agent and see what it can do, I am finding myself asking:

  1. Will Cursor CLI respect the ‘Privacy Legacy Mode’ set in Cursor IDE > Settings?
  2. Will it only run within the repo I run agent from in the terminal?
  3. Will it respect the .gitignore and .cursorignore files within the repo etc?

I have seen posts like Cursor CLI and Editor should sync which make it clear that, currently, the Cursor CLI and Cursor IDE environments are somewhat ‘separate’, so that is why I am not assuming that the CLI ‘inherits’ the same settings as the IDE.

I have looked at the pages underneath the CLI section in the docs but could not locate that information:

  • https://cursor.com/docs/cli/using
  • https://cursor.com/docs/cli/shell-mode
  • https://cursor.com/docs/cli/acp
  • https://cursor.com/docs/cli/headless
  • https://cursor.com/docs/cli/reference/slash-commands
  • https://cursor.com/docs/cli/reference/parameters
  • https://cursor.com/docs/cli/reference/authentication
  • https://cursor.com/docs/cli/reference/permissions
  • https://cursor.com/docs/cli/reference/configuration

I came across this doc, not sure if it is closely related or not:

https://cursor.com/docs/reference/ignore-file

I am a bit concerned where it says:

The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore

Does that mean Cursor CLI and Cursor (when running in Agent view), can see content of files within Node.js .env files and everything else that is usually protected by .gitignore and .cursorignore?

I’ve attached screenshot of the following settings in case it is relevant:

Cursor Settings > Agents > Approvals & Execution for commands, MCP and more

When I start trying to investigate this topic further, I get lost in these docs :confused: :

https://cursor.com/docs/agent/security/run-modes

agents_settings_approvals_etc
agents_settings_approvals_etc1763×926 66 KB

4

This is exactly the kind of thing I would want stated explicitly before using the CLI on a real repo.

IDE settings, CLI config, ignore files, and tool access are four different boundaries. If they do not inherit from each other perfectly, the docs should say that plainly, because users will otherwise assume “same account, same workspace” means the same privacy behavior.

7

Privacy Mode carries over automatically, and the ignore files are respected by the agent’s own tools, with one important caveat on terminal/MCP access. Taking your questions in order:

1. Does the CLI respect Privacy Mode (including the legacy setting)? Yes. Privacy Mode is tied to your account (and your team, if you’re on one), not to a specific app, and it’s enforced on our side. Sign in to the CLI with the same account and it gets the same Privacy Mode treatment as the IDE, with nothing to re-configure.

2. Does the agent only run within the repo you launch it from? It’s oriented around the folder you start agent in (that’s its workspace), and edits are scoped there. Creating or modifying files outside the workspace is gated behind approval (that’s the External-File Protection you saw). It’s not a hard sandbox, though: it can read files outside that folder, and terminal commands can reach the wider filesystem depending on your approval and sandbox settings. How much runs without asking is controlled by your Run Mode / permissions, see Run Modes.

One heads-up: the toggles in your screenshot are the IDE’s settings. The CLI reads its own config at ~/.cursor/cli-config.json (global) and .cursor/cli.json (per project), so set CLI permissions there. See CLI Configuration.

3. Does it respect .gitignore / .cursorignore, and can it read .env files? Both are used, but they do different jobs:

  • .gitignore keeps files out of search and indexing.
  • .cursorignore is the one that actually blocks the agent’s own file tools (read, search, edit) from touching those files.

So for protecting secrets, rely on .cursorignore, not just .gitignore.

The important caveat, and the docs line you quoted, is that terminal commands and MCP tools can still access .cursorignore’d files, because they run at the OS level where Cursor can’t intercept something like cat .env. So .cursorignore reduces exposure but isn’t an absolute wall around secrets (and terminal sandboxing isn’t available on Windows).

Practical setup for .env / secrets with the CLI:

  1. Add patterns to .cursorignore (or your global ignore): **/.env, **/.env.*, **/*.key, **/credentials.json.
  2. In your CLI config, also hard-deny reads: "deny": ["Read(**/.env*)", "Read(**/*.key)"]. This blocks the agent’s read tool from those paths. See CLI Permissions.
  3. Keep your Run Mode conservative (Auto-review sandboxes terminal commands where it can; Run Everything doesn’t).

Full picture on what .cursorignore covers: Ignore files.

@Jason_Luo1 good feedback. Fair that these four boundaries (account settings, CLI config, ignore files, tool access) deserve to be spelled out in one place. I’ll pass it on so we can make the docs clearer here.