Cursor compatibility

Cursor exposes an Override OpenAI Base URL control for OpenAI API requests. That control is not enough to create the same confidential path as OpenCode, Goose, or another local client.

​

Compatibility verdict

The Cursor API key documentation says that custom keys work only with chat models. It also says that all requests are routed through Cursor’s servers for final prompt building. The key is transmitted to Cursor’s backend for each request.

​

Why the base URL is insufficient

The confidentiality problem occurs before Prem receives the request. Cursor’s service can process the prompt while it builds the final request. A Prem proxy deployed after that service can protect the later Prem inference path, but it cannot make the earlier Cursor processing confidential. A loopback URL introduces a second problem. 127.0.0.1 refers to the host making the connection. Cursor does not document its custom provider flow as a direct local request from the editor to that address. Do not assume that the local proxy is reachable from Cursor’s backend.

​

What the current controls establish

Cursor can use custom provider credentials for supported chat models. The installed Cursor settings also expose a base URL override for OpenAI requests. These facts do not establish any of the following:

• that Cursor sends the final request directly from the device to the local Confidential Proxy;
• that Cursor cannot read the prompt, file context, tool output, or provider key;
• that Cursor uses only /v1/chat/completions for every agent feature;
• that Cursor Tab, Cloud Agents, Composer, or other Cursor-hosted features use the custom endpoint;
• that an agent turn, stream, and tool call work end to end through Prem.

​

Use a supported local harness

Use a client that sends Chat Completions directly to the local proxy when the client-to-enclave boundary is required:

• OpenCode for a terminal coding agent.
• Goose for a local agent with built-in and MCP tools.
• OpenClaw or Hermes Agent for broader local automation.
• Claude Code through Prem’s bundled Anthropic-compatible launcher.

The Codex extension can run inside Cursor as an editor extension, but that is a separate client and provider path. See Codex CLI compatibility before assuming it can use Prem.

​

Requirements for confidential support

A confidential Cursor integration would require all of these conditions:

1. Cursor documents a direct client-side provider path or a local extension path that does not send plaintext to Cursor’s service.
2. The path can target http://127.0.0.1:8787/v1 and uses /v1/chat/completions.
3. A bounded text request reaches the local Confidential Proxy.
4. Streaming and tool calls complete without direct-provider fallback.
5. Network inspection confirms that prompt content and the Prem API key do not transit Cursor’s service.
6. Cursor-hosted features that bypass the custom provider are clearly excluded from the guide.

​

Frequently asked questions

​

Does Cursor allow an OpenAI base URL override?

Yes. The current Models settings expose that control. It does not establish a direct or confidential local path.

​

Can I point the override at the Prem proxy anyway?

No, not as a confidential deployment. Cursor’s documented backend processing keeps Cursor in the plaintext trust boundary, and a loopback proxy is not a documented backend-reachable endpoint.

​

Would a publicly reachable proxy solve this?

It may solve network reachability, but it does not remove Cursor from the plaintext path. You would also need TLS, strict network access, and controlled secret handling on the deployed proxy.

​

Does Prem protect Cursor tools and files?

No. Even in a future model integration, Cursor, editor files, terminal commands, extensions, and remote tools remain outside the Prem confidential runtime.

​

Related