Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
It’s unclear what the hierarchy of autorun permissions is.
- Chat → Auto-Run → Auto-Run Mode → Ask every time / Use Allowlist / Run Everything
- Custom modes have an Auto-run option
- Tool calls themselves have a dropdown
Steps to Reproduce
Have an MCP server, set Chat → Auto-Run → Auto-Run Mode → Ask every time, then on a tool call, add to the allow list. There’s no visibility after that interaction that it is in an allow-list, and it no longer asks for permission despite the ‘global’ option stating ask every time.
Expected Behavior
Whatever the hierarchy, it should be clearly defined and enforced.
My suggestion is:
-
Globally “ask-every-time” is a hard and enforced limit. You shouldn’t be able to add individual commands to an allow-list or be able to set Custom Modes to auto-run.
-
Setting the global option to ‘allow-list’ allows a global allow-list, and custom modes to have allow lists. Each custom mode with an allow list should be visible below ‘MCP Allowlist’ to make it clear which ones override. By default, the Mode should auto-populate with the global allow-list, but if a new tool is added to the global list when a Mode already exists, it does not auto-add it later. Have a button to auto-add to all Modes for that action. The Mode allow list overwrites (and is not additive) to the global list. This allows for say, a read only mode.
-
Setting ‘auto-run’ on a particular Mode should make it clear that all tools are auto-run by that mode, and in the MCP Allowlist global view, it should be made clear that they have no allow-list, that all tools may run.
-
Setting ‘Run Everything’ globally should default to run everything, but specific modes can overwrite this behaviour, again make it clear in the global config.
Screenshots / Screen Recordings
Operating System
MacOS
Current Cursor Version (Menu → About Cursor → Copy)
Version: 1.6.27
VSCode Version: 1.99.3
Commit: d750e54bba5cffada6d7b3d18e5688ba5e944ad0
Date: 2025-09-17T20:21:17.042Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Darwin arm64 24.6.0
Does this stop you from using Cursor
No - Cursor works, but with this issue