Reference · Cursor · updated 27 September 2026
Access is gated by the developer who triggered the agent, not by the agent. Here is what its public documentation says about authentication, commit attribution, the sandbox it runs in, how you hand it work, and the limits you will hit.
| Auth | The Cursor GitHub App, installed by an org admin with read/write on chosen repositories. Cursor states access is gated by the triggering developer's git access. |
| Attribution | Commits land under cursor[bot] with a Co-authored-by: Cursor Agent trailer. A forum thread shows the trailer can be pre-empted by a hallucinated trailer in the agent's own commit message. |
| Sandbox | An isolated AWS VM built from a Dockerfile or snapshot, with outbound-domain restrictions. |
| Task intake | cursor.com/agents, @cursor on a GitHub or Bitbucket PR or issue, Slack, Linear, an API, and the iOS app. Forum reports say API-spawned agents cannot post PR comments. |
| Limits | Per-plan usage. Cursor's own forge, Origin, is hosted-only and still keeps GitHub as the system of record. |
Unverified: Commit attribution is observed in user repositories and forum reports; the docs do not specify it.
Every cloud agent in this series invents its own identity and attribution model, because the host gives them nothing to stand on. The consequences are the same across vendors: agents share a person's token or an org-wide app installation, so a fleet hits secondary rate limits as one user; attribution lives in free-text trailers the host never reads; and rules like "a human must approve changes under this path" are left to the agent to enforce on itself.
Paste this to your coding agent. A human approves one code on github.com; the agent does the rest.
Set up githug for owner/repo: run `curl -fsSL https://githug.ai/install | sh`, then `hug init --repo owner/repo --json`. Show me any code or link it prints and wait for it to finish.
Quickstart · Set it up yourself · free during the beta