# Cursor (cursor-agent) with an X-API-Key header: PASS (run on a workstation, not in a sandbox)

Run date: 2026-10-12 (UTC). Endpoint: `https://api.sbx.agent-next.com/mcp/v1`. Client: `cursor-agent`, signed in with an existing Cursor subscription. It is not in the sandbox template and needs your Cursor login, so it ran on a workstation in a scratch project directory with the project-scope `.cursor/mcp.json` the page offers; `$HOME/.cursor/mcp.json` was never touched. The key was read in-process and never printed or logged.
Setup text: the live [For agents page](https://sbx.agent-next.com/docs/agents/#client-cursor), Cursor section: the JSON config, then its verify command.

## Flow

| step | result |
| --- | --- |
| config from the page | PASS |
| `cursor-agent mcp enable sandbox && cursor-agent mcp list-tools sandbox` | PASS: `Enabled and approved MCP server: sandbox`, nine tools |
| session A (`cursor-agent --print --trust --force --approve-mcps`): create, `echo ok; exit 3`, write and read `/tmp/hello.txt`, `ls -l /tmp`, `python3 -m http.server 8000` in the background, preview URL, no kill | PASS: exit code 3 and `ok`; file content `hi`; an external fetch of the preview URL returned HTTP 200; an independent MCP read returned `hi`; PID 1 is `tini`, 0 zombies |
| session B: `sandbox_kill` twice | PASS: `killed: true`, then `already_gone: true`; the preview URL then returned 502 |

## Residue (zero)

- The key's sandbox list was 0 at the end.
- Cursor keeps per-project state under `~/.cursor/projects/<project>/` and chat folders under `~/.cursor/chats/`. A scan of those, `cli-config.json` and the auth file found no copy of the key; the folders the run created were then deleted.

## Open notes

- Non-interactive runs need `--trust --approve-mcps` (the page now says so).