Cybas Agents Bridge

⚠️ WARNING: This MCP server gives a connected AI agent the ability to read, edit, and (optionally, with explicit per-call opt-in) run shell commands in configured workspaces on your machine. Only connect trusted MCP clients to it. Never expose the HTTP mode on a public network without both authentication (CURSOR_BRIDGE_TOKEN or Cloudflare Access) and a bind address of 127.0.0.1/behind a tunnel — treat this as a powerful local admin tool, not a routine utility.

An MCP server that lets Claude Code (or any MCP client) hand off coding tasks to the local Cursor Agent CLI, running in a specific project workspace. Each workspace gets its own persistent Cursor session that automatically resumes across calls, so Cursor remembers prior turns for that project even after you've worked on other projects in between.

Useful for running Claude and Cursor side by side on the same codebase — Claude plans and reviews, Cursor executes, and both stay in sync per project.

Setup

{
  "mcpServers": {
    "cursor-agent-bridge": {
      "command": "node",
      "args": ["/path/to/cursor-agent-bridge/index.js"]
    }
  }
}

Requires the cursor-agent CLI installed and on PATH (or set CURSOR_AGENT_PATH).

Tools

• cursor_agent_delegate — send a prompt + workspace path to Cursor Agent, resuming that workspace's session if one exists.
• cursor_agent_sessions — list all workspaces with an active/remembered session and when they were last used.
• cursor_agent_diff — read-only git status + git diff for a workspace, run directly (not through cursor-agent), so it needs no permission and is always safe to call. Use this to review what changed before committing.
• cursor_agent_commit — stage and commit an EXPLICIT list of files, locally only, never pushes. Requires confirmed: true, set only after showing the user the exact file list and message and getting their approval. Never stages anything beyond the listed files, so unrelated dirty files in the workspace are left alone.
• cursor_agent_push — push an existing local commit to a remote; never stages or commits anything itself. Requires confirmed: true plus expected_head_sha — the push is refused if the workspace's actual HEAD doesn't match, so an approval can't silently apply to a later commit.

Typical workflow, with two separate approval gates instead of one bundled action: cursor_agent_delegate (do the task) → cursor_agent_diff (review what changed) → show diff to user → user approves an exact file list and message → cursor_agent_commit (commit locally, nothing pushed yet) → show the resulting commit SHA → user approves the push → cursor_agent_push (push that exact SHA).

How it works

This bridge delegates project-scoped coding work to the local Cursor Agent CLI.

Shell and SSH permission

File editing is the default mode. Unrestricted shell commands, SSH, and network access are disabled unless the caller opts in for an individual tool call.

A calling Claude or GPT agent must:

1. Explain that enabling shell mode lets Cursor run local and remote commands without further approval.
2. Ask the user for explicit permission in the current conversation and wait.
3. Set both allow_shell: true and shell_permission_confirmed: true only after approval.

Permission is per call and must not be inferred from an earlier task. When enabled, the bridge launches Cursor with --force --sandbox disabled, allowing it to use the Mac's SSH configuration, credentials, and Tailscale routes.

Clients that already loaded the MCP server must restart or reconnect it to see schema or implementation changes.

Timeout

Each call defaults to a 10-minute timeout. Any calling AI (Claude, ChatGPT, etc.) can raise this per call via the timeout_ms parameter, up to a hard cap of 60 minutes.

Running in HTTP mode

By default the server speaks MCP over stdio. Pass --http to instead serve it over Streamable HTTP (for remote clients like ChatGPT connectors):

PORT=8787 CURSOR_BRIDGE_TOKEN=your-shared-secret node index.js --http

Required/optional environment variables:

• PORT — defaults to 8787. The listener always binds 127.0.0.1 — put a tunnel or reverse proxy in front of it for remote access, never expose it directly.
• CURSOR_BRIDGE_TOKEN — a shared secret; callers must send Authorization: Bearer <token>. Required unless Cloudflare Access verification (below) is configured instead.
• CF_ACCESS_TEAM_DOMAIN, CF_ACCESS_AUD, CF_ACCESS_ALLOWED_EMAIL — optional, verifies bearer tokens issued by a Cloudflare Access application (e.g. https://your-team.cloudflareaccess.com) instead of or in addition to the static token. See SECURITY.md for the recommended deployment pattern (Managed OAuth self-hosted Access app).
• CURSOR_ALLOWED_WORKSPACES — optional, comma-separated list of absolute paths. When set, every tool call's workspace must resolve to one of these paths (or a subdirectory); anything else is rejected. Strongly recommended for any HTTP deployment reachable outside your own machine.
• CURSOR_BRIDGE_RATE_LIMIT — optional, max requests per minute per client to /mcp (default 60).