Scope Auto-review run mode per workspace and per MCP server

[ilyachase (Ilya Levin)]

Feature request for product/service

Cursor IDE

Describe the request

Auto-review is one application-wide Run Mode. It applies the same classifier to every workspace and every MCP server. That does not match how the agent is actually used.

A personal repo can stay on Auto-review. A production or client repo should stay on Allowlist, or ask every time. A read-only MCP (docs, search, issue lookup) can go through the classifier. A write-capable MCP (ticket updates, deploys, cloud mutations) should always ask, even when the rest of the session is on Auto-review.

Today the only per-repo lever is .cursor/permissions.json autoRun instructions. Those steer the classifier only while Auto-review is already enabled globally. They cannot turn the mode on for one workspace and off for another. Project-level terminalAllowlist / mcpAllowlist are documented as merged with the user file, but they are not applied. A non-empty user-level allowlist can also lock Auto-review out entirely.

Request

1. Workspace-scoped Run Mode.

• The current user/app setting stays the default.
• A workspace can override it, for example in .cursor/permissions.json, with values like auto-review, allowlist, or ask.
• The override should be committable so a team shares the same safety level.
• The UI should show which scope is active: app default, or this workspace.

2. Per-MCP run policy, independent of the shell Run Mode.

• For each server: always ask, Auto-review classifier, or allowlist.
• Optional finer scope on the approval card: this workspace, global, or this session.
• Example: shell stays on Allowlist, a trusted read-only MCP uses Auto-review, and a mutating MCP always prompts even if the workspace is on Auto-review.

Why existing threads are not this request

• Project autoRun instructions only steer the classifier. They do not select the mode. Auto-review Run Mode - #6 by Colin
• Workspace-aware Auto-Run was requested before Auto-review existed: Add "Blocklist Mode" & Workspace-Aware Agent Safety Settings
• Repo-level settings files, including allowlists: Ability to override settings via cursor/ files (eg allowlist)
• A separate Auto-run MCP toggle, including one switch per server: Separate "Auto-run MCP" Option from "Enable auto-run mode"
• Approval-card scopes for a tool or a whole MCP server (this workspace / global / session): Granular approval options for terminal commands and MCP tool calls
• Project allowlists are not loaded: Project-level .cursor/permissions.json not loaded; ~/.cursor/permissions.json works

This is about the Auto-review mode itself, not another allowlist. The classifier should be something you can turn on for one workspace or one MCP server without turning it on for the whole app.

Operating System (if it applies)

Windows 10/11

[sattyamjjain (Sattyam jain)]

+1, this is needed for MCP servers that can write.

One workaround till Cursor supports this, for servers you own: enforce read vs. write inside the MCP server itself. Cursor’s own docs say “Auto-review is not a security boundary” ( Run Modes | Cursor Docs ), so the classifier approving a call shouldn’t be the last check. Tag each tool as read or write on the server and deny the write ones unless explicitly allowed. Then a wrong approval still fails at the server.

It only works for servers you control, though, so the per-server mode you asked for is still needed for third-party ones.

If useful, this is how we tag tools in agent-airlock (capability flags like FILESYSTEM_READ / FILESYSTEM_WRITE, with a read-only policy that denies the write ones): agent-airlock/src/agent_airlock/capabilities.py at main · sattyamjjain/agent-airlock · GitHub