# zn-gate for Cursor

Install zn's hooks for Cursor: they block reads of .env files with values and credential files, secrets pasted into prompts and MCP calls that carry a secret.

Source: https://usezn.com/docs/install/cursor/

You need Node.js 18 or later. Paste each line in a terminal and press Enter after each one:

```bash
npm install -g zn-gate
zn hooks install cursor
```

Then restart Cursor.

## What you get

- File reads and shell reads of `.env` files with values and credential files are blocked.
- A secret pasted into a prompt is blocked.
- MCP calls that carry a secret value are blocked.

## Limits

- Shell output and file contents are not scrubbed; only MCP output is.
- Write protection is best effort.
- If the zn hook crashes, reads and prompts are blocked; other events run unchecked.
- Not tested on Windows.

To also check the MCP servers you use in Cursor, see [Cursor](https://usezn.com/docs/integrations/cursor/).

## Keep your .env values in the vault

The agent cannot read `.env` files with real values. Move the values into zn-gate's encrypted vault, and the file keeps markers such as `__ZN_STRIPE_KEY__`:

```bash
zn unlock            # creates the vault the first time
zn env shadow .env
```

After this your own app also reads the markers: start it with zn-gate's run command once you allow it. `env shadow` tells you how to undo it. More: [the vault](https://usezn.com/docs/quickstart/#2-keep-your-env-values-in-the-vault).

## Check that it works

In a new terminal, run `zn-gate check`. It should show **OK** for Cursor. [What the output means](https://usezn.com/docs/check/).