Cursor Apps: build, secure and deploy live apps from a prompt

Felix Laurent 6 Nov 2026 3 min read

AI agents

Cursor now builds and hosts live apps. The feature, called Apps, launched on November 5, 2026. Users describe a tool to a cloud agent, and Cursor writes the code with a Postgres database and sign-in. Then it runs security checks and publishes the app at a link.

Cursor's pitch is that agents made code cheap to write, yet most apps users build never leave localhost. Apps is meant to close that gap inside the editor, with no separate hosting service. It is available on all paid plans with cloud agents enabled.

How Apps in Cursor works

Apps runs only through cloud agents. The docs say the feature "is not supported locally." Users start a cloud agent and say plainly that they want an app. Cursor's sample prompts include:

a dashboard of weekly signups with a chart and a table filtered by plan;
an internal tool where a team submits bug reports and tracks their status;
a product launch microsite with an email sign-up form;
"Deploy this repo as an app."

The agent scaffolds a web app, creates a Postgres database if the app needs one and sets up sign-in. If the app has to reach other systems, such as a data warehouse, Cursor asks for the secrets it needs. According to the docs, the agent never sees the secret values.

A tray in the editor shows a preview. At publish time the user picks a unique URL and Cursor returns a live link. Apps can start from scratch, in which case Cursor creates a new repo on Cursor Origin, its own git platform. Existing repos from Origin and GitHub work too. GitLab support is coming soon.

Each team gets a dedicated hosting account, isolated from other teams and users. Cursor does not name the hosting provider.

Before any of that goes live, the app has to pass Cursor's checks.

Security checks before publishing

Cursor runs four fixed checks before every publish, even when the AI review is off:

block secrets written into app files;
block credential files such as private keys and service-account keys;
never publish .env files;
never publish source maps.

On top of that, an AI security review reads the app files and blocks serious issues. If a check fails, the agent says what to fix. "Nothing goes live until the checks pass and you explicitly publish the app," Cursor writes in its changelog.

Team admins get more control. They can see every app and secret on the team, add their own instructions to the AI review and unpublish any app. They can also approve a publish the review blocked, except for malicious code, hardcoded secrets or exposed credentials. Every change goes into the team audit log.

Who can open a Cursor app

Apps have three sharing levels:

people you invite, signed in to Cursor;
your whole Cursor team, signed in;
public, for anyone with the link.

Public sharing is off by default on Teams and Enterprise plans, and only an admin can turn it on. Individual plans can share apps publicly. Scripts and bots that cannot sign in use a Cursor API key, sent only as a request header. Cursor marks those requests as automated.

That default tells you who Cursor built this for first. Its examples are internal: event registration, desk seating, account assignments, sales dashboards, onboarding programs and developer portals.

What Cursor has not said

The changelog and docs leave several questions open. Cursor gives no prices or usage costs for hosting and the database. It names no limits on storage, compute or traffic. Custom domains are not mentioned, only a unique URL that can be changed later. There is no version number either, so users need to update Cursor to the latest build to see the feature.

Those gaps matter because the comparison is obvious. Lovable, Replit and Vercel's v0 already turn a prompt into a deployed app. Cursor's difference is the audience. It sells to engineering teams that already work in Cursor and want internal tools behind company sign-in.

Is Cursor Apps worth using for internal tools

For teams already paying for Cursor, it is a sensible default for small internal tools. Sign-in, a database, secrets handling and a publish gate come built in, and admins keep the final say. That removes the usual reason an internal dashboard never ships: nobody wants to set up hosting and access control for it.

The open question is cost. Until Cursor publishes pricing and limits, it is hard to judge Apps for anything that has to run for months or serve many users. It also ties code, hosting and git closer to Cursor, which is now part of SpaceX. For quick team tools that is a fair trade. For anything customer-facing, teams should wait for the numbers.