I pretty much want to allow Cursor to run any command except a few (mostly git add and git commit but also any console like rails console rails c etc. I can’t figure out how the allow and deny list exactly work. For instance all rails command can be called with or without bundle exec but that’s fi…

Yeah it would be great to have some better documentation around this with some real world examples.

It is not a simple exact match on the command name (executable). I’ve added git and it still ask about git log ... commands. So is it a pattern on the whole command line? In general the lack of sanboxing is a bit turnoff. Hope they will focus on this in the future (if not, at least provide a guide…

@cursor Any news or positioning how these rules work?

+1 here. It’s a safety-critical alternative for babysitting each action of the AI agent. It needs to be better specified. Even without malicious AI hijacks I’ve seen enough sudden AI meltdowns where it would go haywire and start randomly breaking things. For now I keep an IntelliJ IDE running in pa…

I tested locally and can confirm that it works as follows: By default (empty deny and allow) no commands are allowed Allow acts as a whitelist/allowlist so only commands in there will be allowed to run Deny will take priority over allow and block anything that is allowed. Terminal logs: ◦ cat ~/…

I’ve also noticed that the allow list matches the first part of the command. So cd will match any command beginning with cd. npm will allow any and all npm commands, including npm install. Note, that this is what will be added to the allow list if you allow from chat. Alternatively, you can got …

+1 to the above. I explictly need confirmation that the allowlist does not support subcommands. Allowing pnpm test also allows pnpm install which seems like a MAJOR security issue. If I think that the allow list blocks subcommands and then it doesn’t, I’m leaving a huge hole in my workflow even with…

Hey, good catch. Right now the agent just uses prefix matching, so the best fix is to put dangerous subcommands like pnpm install right into the deny list. Since deny always overrides allow, it is really the only way to get granular control until we get official regex or exact-match support.

What deny list? I don’t see any deny list in the UI.

How does command allowlist/denylist really work?

Support Help

CK-iRonin.IT (CK) June 29, 2025, 8:07pm 4

You can sandbox with dev containers but the command matching is messed up.
Hey @cursor, fix it…………

2 Likes

Topic		Replies	Views
Simplify command denylist/whitelist, make them useful and clear how they work Feature Requests	3	1589	July 15, 2025
Lack of denylist will bite someone sooner or later - give users control Feature Requests	4	235	March 20, 2026
Support sub-command allow/deny list (e.g. `git status`) Feature Requests	3	377	December 23, 2025
Allowlist is too easy to add to Feature Requests	9	1803	February 4, 2026
Where is the terminal command allowlist? Help mcp , auto-run	7	582	March 2, 2026

How does command allowlist/denylist really work?

Related topics