> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Cursor compatibility
> Understand why Cursor's custom OpenAI base URL is not currently a supported confidential Prem integration.
Cursor exposes an **Override OpenAI Base URL** control for OpenAI API requests. That control is not enough to create the same confidential path as OpenCode, Goose, or another local client.
Cursor is not currently supported as a Prem confidential integration. Cursor's documentation states that requests pass through Cursor's servers for final prompt building and that the provider API key is sent through those servers with each request.
## Compatibility verdict
| Requirement | Current result |
| -------------------------------------- | ------------------------------------------------------ |
| Custom OpenAI base URL control | Available in Cursor Settings under Models and API Keys |
| Standard chat models with a custom key | Documented by Cursor |
| Direct local call to `127.0.0.1:8787` | Not documented or verified |
| Prompt hidden from Cursor's service | No |
| Client-to-Prem-enclave confidentiality | Not established |
| End-to-end Prem test | Not completed |
The [Cursor API key documentation](https://cursor.com/help/models-and-usage/api-keys) says that custom keys work only with chat models. It also says that all requests are routed through Cursor's servers for final prompt building. The key is transmitted to Cursor's backend for each request.
## Why the base URL is insufficient
```mermaid theme={"system"}
flowchart TB
subgraph Device["Your device"]
C["Cursor
prompt, files, and tool context"]
L["Local Confidential Proxy
127.0.0.1:8787"]
end
C -->|"Prompt and provider key"| S["Cursor services
final prompt building"]
S -.->|"Custom OpenAI endpoint, if reachable"| R["Remote endpoint or deployed proxy"]
L -.->|"Not a documented direct path"| S
R -->|"Encrypted only after the proxy receives plaintext"| G["Prem API Gateway"]
G --> E["Prem confidential runtime"]
```
The confidentiality problem occurs before Prem receives the request. Cursor's service can process the prompt while it builds the final request. A Prem proxy deployed after that service can protect the later Prem inference path, but it cannot make the earlier Cursor processing confidential.
A loopback URL introduces a second problem. `127.0.0.1` refers to the host making the connection. Cursor does not document its custom provider flow as a direct local request from the editor to that address. Do not assume that the local proxy is reachable from Cursor's backend.
## What the current controls establish
Cursor can use custom provider credentials for supported chat models. The installed Cursor settings also expose a base URL override for OpenAI requests.
These facts do **not** establish any of the following:
* that Cursor sends the final request directly from the device to the local Confidential Proxy;
* that Cursor cannot read the prompt, file context, tool output, or provider key;
* that Cursor uses only `/v1/chat/completions` for every agent feature;
* that Cursor Tab, Cloud Agents, Composer, or other Cursor-hosted features use the custom endpoint;
* that an agent turn, stream, and tool call work end to end through Prem.
## Use a supported local harness
Use a client that sends Chat Completions directly to the local proxy when the client-to-enclave boundary is required:
* [OpenCode](/guides/opencode) for a terminal coding agent.
* [Goose](/guides/goose) for a local agent with built-in and MCP tools.
* [OpenClaw](/guides/openclaw) or [Hermes Agent](/guides/hermes) for broader local automation.
* [Claude Code](/guides/claude-code) through Prem's bundled Anthropic-compatible launcher.
The Codex extension can run inside Cursor as an editor extension, but that is a separate client and provider path. See [Codex CLI compatibility](/guides/codex-cli) before assuming it can use Prem.
## Requirements for confidential support
A confidential Cursor integration would require all of these conditions:
1. Cursor documents a direct client-side provider path or a local extension path that does not send plaintext to Cursor's service.
2. The path can target `http://127.0.0.1:8787/v1` and uses `/v1/chat/completions`.
3. A bounded text request reaches the local Confidential Proxy.
4. Streaming and tool calls complete without direct-provider fallback.
5. Network inspection confirms that prompt content and the Prem API key do not transit Cursor's service.
6. Cursor-hosted features that bypass the custom provider are clearly excluded from the guide.
## Frequently asked questions
### Does Cursor allow an OpenAI base URL override?
Yes. The current Models settings expose that control. It does not establish a direct or confidential local path.
### Can I point the override at the Prem proxy anyway?
No, not as a confidential deployment. Cursor's documented backend processing keeps Cursor in the plaintext trust boundary, and a loopback proxy is not a documented backend-reachable endpoint.
### Would a publicly reachable proxy solve this?
It may solve network reachability, but it does not remove Cursor from the plaintext path. You would also need TLS, strict network access, and controlled secret handling on the deployed proxy.
### Does Prem protect Cursor tools and files?
No. Even in a future model integration, Cursor, editor files, terminal commands, extensions, and remote tools remain outside the Prem confidential runtime.
## Related
Read Cursor's current provider-key and backend-routing boundary.
Use a tested local coding-agent path through Prem.
Review supported routes, modes, and key handling.
Review the protected and unprotected parts of the request path.