Cursor

Vectimus governs Cursor through its native preToolUse hook system. Shell commands, file edits, file reads and MCP tool calls are all intercepted before execution.

Setup

vectimus init

If Cursor is detected (the cursor binary is on your PATH or ~/.cursor/ exists), vectimus init writes the hook configuration automatically.

The generated config lives at .cursor/hooks.json in your project directory:

{
  "version": 1,
  "hooks": {
    "preToolUse": [
      {
        "command": "vectimus hook --source cursor"
      }
    ]
  }
}

If you already have hooks in .cursor/hooks.json, Vectimus merges its hook with your existing ones. Your custom hooks are preserved.

How it works

1. Cursor fires the preToolUse hook before every tool call
2. The hook sends the tool name and arguments to vectimus hook via stdin as JSON
3. Vectimus normalises the payload, evaluates it against Cedar policies and returns a decision
4. On deny, Vectimus exits with code 2 and writes the rejection reason to stderr
5. Cursor blocks the tool call

Supported tools

Limitations

Cursor does not support "ask" on preToolUse hooks. Escalate verdicts fall back to deny with a [escalate] prefix message. Server mode can implement real approval workflows.

Observe mode

To trial Vectimus without blocking:

vectimus observe on

All decisions are logged to ~/.vectimus/logs/ but tool calls proceed normally. Review the audit log, then switch to enforcement:

vectimus observe off

Performance and audit

The evaluation daemon auto-starts on the first hook call and keeps the Cedar engine warm in memory, reducing latency from ~200ms to under 10ms. Every evaluation produces an Ed25519-signed governance receipt stored in .vectimus/receipts/. Receipts are retained for 7 days by default (configurable via [receipts] retention_days in config). Use vectimus verify to validate receipts offline and vectimus receipts prune for manual cleanup.

Remove hooks

vectimus remove

This strips Vectimus entries from .cursor/hooks.json while preserving your other hooks.