Cursor announced on November 5, 2026 that its cloud agents can now take an app from a plain request all the way to a hosted, shareable link. The feature, called live apps, covers scaffolding the web app, creating a Postgres database when one is needed, adding sign-in through Cursor SSO and setting up hosting.
This matters because the editor is moving past writing code into running it. Teams that use Cursor for internal tools no longer need a separate platform to deploy small dashboards or portals, and admins get one place to review what is published and which secrets each app holds.
What changed
Until now, an app made with a Cursor agent typically stayed on the developer's own machine unless someone set up hosting by hand. Cursor says that gap is the reason for this release: many generated tools were useful but never reached the people who needed them.
With live apps, a user starts a cloud agent and states clearly that the goal is an app. The agent then handles the full stack, and the user picks a unique domain at publish time to receive a working link.
Key details
- Database: a Postgres instance is created automatically when the app calls for stored data.
- Authentication: apps sit behind Cursor SSO by default, so viewers must sign in.
- External systems: if the app must reach something like a data warehouse, the agent asks for the needed secrets.
- Repositories: apps can come from new or existing repos on Cursor Origin or GitHub, with GitLab and other providers listed as coming later.
- Sharing: access can go to named people, groups or the whole team; individual plans may also share publicly.
- Programmatic use: a Cursor API key can be issued so a script or bot can call the app.
- Availability: every paid plan that has cloud agents turned on.
How the security checks work
Before anything goes live, Cursor runs two kinds of review on the app. One set is rule based and deterministic, and the other is performed by an agent, and both look for common mistakes such as credentials left in source files.
When a check fails, the agent explains what has to change. The app stays unpublished until the problems are fixed and the user takes an explicit publish step, so a passing review alone does not push it live.
Team admins have wide control. They can list every app and every stored secret, write extra rules for the review, approve a publish that the review stopped, and take down any app at any time.
What it means for developers
For engineering teams, the main gain is speed on throwaway and internal tools. Cursor itself lists examples such as seat planning, onboarding guides, sales pipeline dashboards and service portals, which are the kind of small apps that often wait months for a free developer.
The flip side is governance. When people outside engineering can publish apps that hold real data, platform owners should decide early which data sources agents may connect to and who reviews blocked publishes. Treat the built-in review as a first filter, not a full security audit.
Before giving agents broad data access, read up on the lethal trifecta in AI agent security.
Database developers should also look at what the generated Postgres schema contains before an app grows. Agent-built tables can work well for a prototype but may lack indexes, constraints and backup plans that a long-lived tool needs.
Finally, the hosting is tied to Cursor sign-in by default. That is safer for internal use, but it also means the app depends on Cursor accounts and plans, which is worth weighing for anything business critical.
How to get started
Update the Cursor client, make sure cloud agents are enabled on your paid plan, and open a new cloud agent session. Describe the tool you want and say directly that it should be built as an app, then follow the prompts for any secrets.
When the agent finishes, choose a domain, review the results of the security checks and publish. Start with a low-risk internal tool and a small audience, and ask your team admin to set custom review rules before wider rollout.
Conclusion
Live apps turn Cursor cloud agents into a build and hosting service for internal web tools, complete with a Postgres database, SSO and mandatory pre-publish checks. It is available now on paid plans with cloud agents, and teams should pair it with clear rules on data access and app ownership.
Sources
See my articles more often when you search Google.
