Choose where Cloud Agents run
Cursor-managed Cloud Agents are the recommended path for most teams. Cursor manages VM provisioning, isolation, scaling, updates, and environment lifecycle.
Bring your own machine runs Cloud Agent tools on hardware you manage. The agent loop and inference remain in Cursor.
Which runtime should you choose?
Do written policies require the repository checkout and tool execution to stay inside your perimeter?
This requirement usually comes from a compliance or security policy, not a team preference. The agent loop and inference remain in Cursor.
Bring your own machine
perimeter constraint
Do agents need internal services that remain unreachable through Tailscale, PrivateLink, or egress allowlists?
Cursor-hosted agents can reach most private networks through Tailscale, PrivateLink, or egress allowlists.
Bring your own machine
network reach
Do you need a custom OS, special hardware, or persistent local disk for a large repo?
Cursor-hosted agents run on Ubuntu VMs. Use a Dockerfile to customize tooling. Contact your enterprise account team for ARM support.
Bring your own machine
hardware / disk
Cursor-hosted Cloud Agents
Managed infrastructure · elastic concurrency · all Cloud Agent features
Start with Cursor-managed Cloud Agents
Use managed Cloud Agents when they meet your requirements:
- Cloud Agent environments for setup commands, Dockerfiles, snapshots, and secrets.
- Network access controls that restrict outbound domains by user, team, or environment.
- Tailscale or a similar client for services in a VPC or intranet.
- Private connectivity for supported private source control, package registries, and APIs.
Choose managed Cloud Agents for isolated remote VMs and general security requirements without a specific infrastructure constraint. Cursor supports Privacy Mode for both managed Cloud Agents and BYOM.
When to bring your own machine
Use BYOM for requirements managed Cloud Agents cannot meet:
- Private network access. Run tools inside the network that hosts your source control, internal services, package registries, or secret stores.
- Custom hardware. Use GPUs, large-memory machines, or specific operating system images.
- Infrastructure controls. Apply your organization's network access and monitoring policies to workers.
- Repository locality. Keep the full checkout inside your network. Cursor can still process and store agent transcripts containing code data.
Choose a BYOM configuration
Pools are the recommended BYOM configuration for teams and enterprises. Pools provide shared workers, service account authentication, routing, and centrally managed infrastructure.
My Machines connects one user's laptop or devbox for personal workflows. Teams and enterprises should use Pools for shared capacity.