zn-gate for Cursor

You need Node.js 18 or later. Paste each line in a terminal and press Enter after each one:

npm install -g zn-gate
zn hooks install cursor

Then restart Cursor.

What you get

• File reads and shell reads of .env files with values and credential files are blocked.
• A secret pasted into a prompt is blocked.
• MCP calls that carry a secret value are blocked.

Limits

• Shell output and file contents are not scrubbed; only MCP output is.
• Write protection is best effort.
• If the zn hook crashes, reads and prompts are blocked; other events run unchecked.
• Not tested on Windows.

To also check the MCP servers you use in Cursor, see Cursor.

Keep your .env values in the vault

The agent cannot read .env files with real values. Move the values into zn-gate's encrypted vault, and the file keeps markers such as __ZN_STRIPE_KEY__:

zn unlock            # creates the vault the first time
zn env shadow .env

After this your own app also reads the markers: start it with zn-gate's run command once you allow it. env shadow tells you how to undo it. More: the vault.

Check that it works

In a new terminal, run zn-gate check. It should show OK for Cursor. What the output means.