Cursor Agents Now Build and Host Live Apps

Cursor said on Nov. 5 that its cloud agents can now build a working web app, set up a database and sign-in, and publish it to a live link, a move that takes the AI coding editor from writing code into hosting the result. "Agents have lowered the cost of writing code, but most apps and tools that users build never make it off of localhost," the company wrote in its changelog.

Key takeaways

• Cursor cloud agents can scaffold a web app, provision a Postgres database, add sign-in behind Cursor SSO and deploy it on Cursor-run hosting.
• Four automated checks, including blocks on hardcoded secrets and .env files, run before every publish, followed by an AI security review.
• The feature is available on all paid plans with cloud agents enabled; Cursor has not published separate pricing or usage limits.

How Cursor live apps work

Users start a cloud agent and "tell it explicitly that you want to build an app," according to the Nov. 5 changelog entry. The agent then scaffolds the app, spins up a Postgres database if needed, configures authentication and provisions hosting.

Cursor's documentation says each app is deployed in a dedicated hosting account the company creates for a team, or for an individual user, and isolated from other customers. Secret values are not shown to the agent, the docs say. Apps can be deployed from new or existing repositories on Cursor Origin and GitHub, with GitLab support "coming soon."

When publishing, users pick a unique domain and get back a live link, which can be changed later. The feature does not run in the local editor. "Remember to use a cloud agent; this feature is not supported locally," the docs say.

Security checks before every publish

"Nothing goes live until the checks pass and you explicitly publish the app," the changelog says. The documentation lists four checks that are always on, even when the separate security review is turned off: blocking secrets written in app files, blocking credential files such as private keys, never publishing .env files and never publishing source maps.

An AI security review then reads the app's files and blocks serious issues. Team admins can add custom instructions to that review but cannot remove Cursor's built-in checks. Admins can override a blocked publish, except when the review finds malicious code, hardcoded secrets or exposed credentials.

Who can open a Cursor app

Apps can be shared with invited people, with a whole Cursor team, or publicly with anyone who has the link. Public sharing is off by default for Teams and Enterprise accounts and needs an admin to turn it on. Scripts and CI jobs can call a private app with a Cursor API key sent in an x-cursor-app-token header; the docs say the key works "only as a header."

Why it matters for AI coding tools

The launch extends a string of Cursor updates aimed at closing the gap between generated code and finished software. On Oct. 13 the company opened an Origin app marketplace that included deploy apps from Vercel, Cloudflare and Netlify, and on Oct. 20 it released an Agent SDK. Hosting the app itself puts Cursor closer to prompt-to-app builders and adds a deployment layer the company now runs directly.

Built-in guardrails also respond to a known weakness of agent-written software: code that looks finished but fails quietly, as seen in tests of LLM bug-fixers that broke working code.

What's next

Cursor has not said how app hosting will be metered, what usage limits apply or which provider runs the Postgres databases. GitLab support is the only roadmap item named on the changelog.

FAQ

Which Cursor plans can build live apps?

All paid plans that have cloud agents enabled, according to Cursor. It does not work with local agents.

Can a Cursor app be made public?

Yes. Individual users can share an app with anyone who has the link. On Teams and Enterprise plans, public sharing is disabled until an admin enables it.

What stops an app from leaking API keys?

Every publish runs checks that block secrets in app files, credential files, .env files and source maps, plus an AI security review. Admins cannot override blocks for hardcoded secrets or exposed credentials.

References

• Build Live Apps in Cursor — Cursor Changelog (Nov. 5, 2026)
• Apps — Cursor Docs