cursor enterprise hooks example

The Hooks File

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      { "command": "/opt/company/cursor-shell-policy.sh", "timeout": 10, "failClosed": true }
    ],
    "beforeMCPExecution": [
      { "command": "/opt/company/cursor-mcp-policy.sh", "timeout": 10, "failClosed": true }
    ]
  }
}

Shell Policy Script

#!/bin/bash
# beforeShellExecution: reads {"command", "cwd", ...} on stdin.
cmd=$(jq -r '.command // ""')
if printf '%s' "$cmd" | grep -Eq 'terraform[[:space:]]+destroy|git[[:space:]]+push.*--force|rm[[:space:]]+-rf[[:space:]]+/'; then
  printf '%s' '{"permission":"deny","user_message":"Blocked by company policy","agent_message":"This command is not allowed. Propose the change in a PR instead."}'
  exit 0
fi
printf '%s' '{"permission":"allow"}'

MCP Policy Script

Field names are snake_case: user_message and agent_message. Exit code 2 also denies; invalid JSON blocks. The MCP hook receives tool_name, tool_input and mcp_server_name; its command field, present only for stdio servers, is the server’s launch command, not the tool call. Both scripts need jq on every machine: with failClosed: true, a missing dependency blocks every call, so ship it with the scripts.

Failproof can run here too: the form failproofai config writes is failproofai --hook preToolUse --cli cursor in ~/.cursor/hooks.json, at user scope and without failClosed. For enforcement the user cannot remove, put that entry in the system hooks.json with failClosed: true. These are the pre-tool command forms failproofai config writes into each agent’s hook file: user scope, except Codex, which it writes to the managed /etc/codex/config.toml when it can run as root. They cover only the pre-tool gate. failproofai config also registers post-tool output redaction, prompt, stop and session events, so keep its install alongside any system entry. Placing them in the system or managed locations below, and keeping them there with MDM, is your configuration rather than a documented Failproof install path; talk to us about a managed deployment.

#!/bin/bash
# beforeMCPExecution: reads {"tool_name", "tool_input", "mcp_server_name", ...} on stdin.
input=$(cat)
server=$(printf '%s' "$input" | jq -r '.mcp_server_name // ""')
tool=$(printf '%s' "$input" | jq -r '.tool_name // ""')
case "$server:$tool" in
  github:*|docs:*) printf '%s' '{"permission":"allow"}' ;;
  *) printf '%s' '{"permission":"deny","user_message":"MCP server not approved","agent_message":"This MCP tool is not on the company allowlist."}' ;;
esac

Cursor’s Other Admin Controls