Cursor Agent SDK Docs Read: Deploy From Git, Egress Allowlists, Secrets, and a Package Name That Differs From the Launch Post

Cursor's launch post says the Agent SDK is "generally available today" and that you can define agents in code and run agent-sdk deploy to put one on Cursor infrastructure. The deployment docs are where the operational detail sits: what ships, how egress and secrets work, and what survives a redeploy. They also show a package name that differs from the one in the launch post.

I read the launch post (dated October 20 on Cursor's blog), the Agent SDK overview page, the deployment page and the CLI reference page. I did not install or run anything, and I checked package metadata on the npm registry (see the package name section). The claims below are what Cursor's pages say.

What the launch post says

Per the post, the Agent SDK is the framework Cursor uses to build its own managed agents such as Bugbot, Security Reviewer and Rollouts. An agent is a project: Markdown prompts, TypeScript tools, connections to outside services and evals. Agents can respond to pull request events from GitHub, GitLab or Bitbucket, hand tasks to other agents, or split a job among parallel subagents. The post says it supports evals and event replay.

Two examples in the post are Cursor's own claims: a team built "kb-reviewer" in "about a day", and the PGA Tour is quoted as using the SDK for its software development factory. Neither comes with numbers I can check.

What the docs add

The overview page says the SDK uses the Cursor SDK harness that powers Bugbot, Security Review, Approval Bot and Rollouts. It compares three options:

• Cursor Automations: a prompt, model and trigger in the dashboard, Cursor-managed.
• Grok Bot: instructions, skills and connected tools in the app, Cursor-managed.
• Agent SDK: a versioned Markdown and TypeScript project, on Cursor-managed hosting or your own infrastructure.

The overview page's own guidance: choose the SDK when you want code around model judgment that your team can version control, review, test and "hillclimb".

Deploying

Per the deployment page, agent-sdk deploy builds a pushed Git ref, so uncommitted changes do not ship. It waits until the agent is running and prints a URL. You can pass --repo, --ref, --path and --slug when the checkout is not the one you want. Redeploying the same slug replaces the watched repositories, so you pass every --cursor-events-repo value again, or the deployment watches only its GitHub source repository.

Privacy Mode. The page says managed hosting stores your repository and the agent's data. Under Privacy Mode it is available, with deployment data stored the same way as without Privacy Mode. Under "Privacy Mode (Legacy)" it is not available, and deploy, a hosted session and an eval run all refuse. If your team enforces a privacy setting, that decides whether you can use managed hosting at all.

Egress and secrets

This is the section I would read twice.

• You declare hosts and secret names in the agent definition under hosting.egressDomains and hosting.secretNames. Hosts are lowercase hostnames with no scheme or path. A port is added only for raw TCP.
• Your team's egress policy limits which hosts you can list. The page gives four modes: no mode set, allow all network access, defaults plus team allowlist, and team allowlist only. In the first two, every host you list is allowed. The page says no team list can remove the platform base, which includes Cursor's API and the npm registry.
• A team wildcard *.example.com covers the apex and subdomains. An agent-level *.example.com skips the apex, so you list example.com too.
• A raw TCP host such as a database needs a team entry in CIDR:port form covering every public IPv4 address it resolves to.
• If a host is blocked, deploy fails and names it. A running deployment keeps the policy from its last successful deploy.
• Secrets: you commit names, never values. After deploy you set each value at a hidden prompt with agent-sdk secret set, and the next task uses it without a redeploy. The page says not to pass NAME=VALUE, and not to use a name starting with CURSOR_. Hosted secrets arrive after modules load, so you read them inside the handler, tool or callback.
• On Cursor hosting, the page says a badly signed webhook delivery is rejected before it reaches your agent, when the channel uses a named secret.

Calling a deployed agent

The page shows a custom route called on a stable alias URL with an X-Agent-Alias-Token header. The first deploy prints the alias token once. If it leaks or is lost, agent-sdk deployment rotate-token replaces it. The page warns that deployment --json output can include access headers. It reserves publicEndpoint() for webhook providers that cannot send the token and whose signature the channel verifies.

State across replacements

Per the page, sessions, ctx.host.kv and ctx.host.files survive restarts and redeploys. Anything else the agent writes to disk can disappear.

Self-hosting

The page says to run Node 22.13 or newer, never Bun, and shows agent-sdk serve with a bearer token and a state root. Before exposing it: put TLS or an authenticating proxy in front, keep the bearer token unless a proxy authenticates every caller, keep the state root on a backed-up persistent volume outside the repository, and turn on schedules in only one process per project.

The package name mismatch

The launch post's example imports defineAgent from @cursor/agent-sdk. The docs overview and deployment pages install @grok/agent-sdk and import from it, and the overview says "The package was @cursor/bdk before."

I checked the public npm registry metadata (a read-only request, nothing installed) on October 29:

• @grok/agent-sdk exists. Latest version 0.5.0, created October 22, 2026, last modified October 28. The description reads "Build, test, and deploy agents as code on Cursor's agent harness." The homepage is cursor.com and the repository field points to github.com/cursor/cursor. Its maintainers include an account named eric-anysphere.
• @cursor/bdk exists. Latest version 0.5.0, created September 22, 2026, with the same description and repository.
• @cursor/agent-sdk, the name in the launch post's snippet, returned "Not found".

I fetched the docs page directly, and the raw page and its Markdown version both say @grok/agent-sdk, so the mismatch is real and not a cached copy. My reading: the docs are current and the launch post's import name does not match a published package. I cannot tell why Cursor uses a @grok scope. The docs also mention a "Grok Bot" product and I read nothing explaining it. Registry metadata shows who published a package and what it claims, not that the name is endorsed, so confirm through Cursor's own docs before you install. Treat the launch post's import line as stale until Cursor fixes it.

What I would check

These are my untested suggestions.

1. Install from the name the docs use, @grok/agent-sdk, and check the docs index that ships with the package. Do not copy the launch post's import line.

2. Check your Privacy Mode setting before you plan on managed hosting.

3. Write your egress list first. Run agent-sdk info as the page describes to see the combined hosts, then compare with your team policy.

4. Test a failed deploy on purpose with a blocked host, to see the error before you need it.

5. Decide where state lives. Use the surviving stores (ctx.host.kv, ctx.host.files) and treat disk as temporary.

6. Plan token rotation. The alias token is printed once.

7. Ask about price. I did not find pricing on the pages I read.

What I would not conclude

• That the SDK is stable for your use. "Generally available" is Cursor's label, and the package rename suggests recent change.
• That the kb-reviewer or PGA examples will repeat for you.
• That managed hosting is free or cheap. I read no pricing.
• That the @grok scope is unrelated to Cursor. The registry metadata points to cursor.com and a cursor repository, but I did not verify ownership beyond that.

Frequently asked questions

Is the Cursor Agent SDK generally available?

The launch post says "The Agent SDK is generally available today."

How do I deploy an agent?

Commit and push, then run agent-sdk deploy. It builds the pushed ref, so uncommitted changes do not ship.

Can I self-host?

Yes, per the docs: run agent-sdk serve on Node 22.13 or newer, behind TLS or an authenticating proxy.

How are secrets handled?

You declare names in code and set values with agent-sdk secret set at a hidden prompt. Per the docs, the next task uses the new value without a redeploy.

What controls network access?

hosting.egressDomains plus your team's egress policy. A blocked host makes deploy fail.

What survives a redeploy?

Sessions, ctx.host.kv and ctx.host.files. Other disk writes can disappear.

Which package do I install?

The docs say @grok/agent-sdk, which exists on npm. The launch post's snippet imports @cursor/agent-sdk, which I did not find on npm. Use the docs name.

Sources

All read on October 29, 2026.

• Introducing the Agent SDK (Cursor blog, October 20, 2026)
• Agent SDK (Cursor docs)
• Deploy an Agent SDK project (Cursor docs)
• Agent SDK CLI (Cursor docs, command index only)
• @grok/agent-sdk on npm (npm registry metadata, read October 29, 2026)

Not read: the rest of the docs, the CLI reference beyond the command catalog, pricing pages, the package contents, and the SDK source. For the registry I read only package metadata.