Skip to content

OpenCursor 0.1.3

Choose a tag to compare

View all tags
@noah-thing noah-thing released this 29 Oct 22:27
· 30 commits to main since this release
v0.1.3
b4c8136

Security fixes

Please update. Both fixes protect you when you open a project you did not write, such as a repository you just cloned.

  • Project MCP servers now ask first. Before, an mcp.json inside a project (.cursor/mcp.json or .open-cursor/mcp.json) could start programs on your computer without asking. Now OpenCursor shows the exact command or address and where it came from, and starts the server only after you choose Allow. Your answer is remembered, and you are asked again if the file changes. In a folder you have not trusted, project servers never start. Servers in your own home folder config work as before.
  • A project can no longer change risky settings. Before, a project's .vscode/settings.json could change where requests are sent (and with them your API key) or loosen what the agent runs without asking. Provider addresses, the run without asking level, the command allow and deny lists, and the CLI paths and extra arguments now only come from your own user settings.

Install

macOS and Linux:

curl -fsSL https://opencursor.org/install.sh | sh

Windows (PowerShell):

irm https://opencursor.org/install.ps1 | iex

Already have OpenCursor? It offers this update by itself, or run Check for Updates from the command palette.

Builds are not signed yet, so a downloaded file needs one extra step the first time (the install commands skip it):

  • macOS: open the app once, then System Settings > Privacy & Security > Open Anyway.
  • Windows: on the SmartScreen prompt, choose More info > Run anyway.
Assets 14
Loading