Cursor#

Cursor can use your own OpenAI-compatible endpoint, but two things make it different from other agents:

  • Cursor’s own servers make its model calls, not your computer, and Cursor refuses private addresses. A Lockpin on 127.0.0.1 cannot be reached, so you need a Lockpin that Cursor’s servers can reach over the internet, over HTTPS: a team server.

  • Cursor cannot send custom headers, so it cannot name a task or set a budget. Cap it with a key instead.

lockpin connect cursor changes nothing on this machine. It prints the steps below.

1. Run a team server with a key per person#

Run Lockpin as a team server behind TLS, reachable from the internet. See Set up a team.

Create a key for each person, with the limits you want:

lockpin keys create cursor-alice -day 10 -month 100     # prints lp_... once

Start the server with -default-budget 0, so the key limits are the cap:

lockpin -keys lockpin-keys.json -default-budget 0 ...

-default-budget 0 matters. With no task header, every Cursor call goes to the task <key name>/default, and with a default budget in place that single task is capped at $1.00 in total and stops after that.

Use one key per person, and per purpose if you want to see them apart. lockpin keys list shows each key’s spend. See Keys.

2. Point Cursor at it#

  1. In Cursor, open Settings > Models > API Keys.

  2. Turn on Override OpenAI Base URL and enter:

    https://YOUR-LOCKPIN-HOST/openai/v1

  3. Paste your lp_... key as the OpenAI API key.

Cursor sends the key as Authorization: Bearer, which a Lockpin team server accepts. Menu names change between Cursor versions: look for the OpenAI base URL override.

Only chat goes through Lockpin. Tab completion keeps Cursor’s own models. Cursor’s own admin spend limits may suit a whole team better.

When the cap hits#

The key’s limits are checked before every call. A call that would pass one gets HTTP 402, with the limit and when it resets, before it reaches the provider. Cursor shows its own error for a failed request to a custom endpoint. The lockpin: message is in the response body, and the meter and lockpin keys list show what was spent. This has not been tested against Cursor.

Review prompts before they are sent#

Lockpin’s prompt review runs as Cursor’s beforeSubmitPrompt hook on your own machine, so it works without a team server. It blocks a prompt that holds a secret or whose fixes would save at least $0.10 or 20,000 tokens this turn. Cursor shows a hook’s message only when it blocks, so smaller findings are not shown.

lockpin hooks install -agent cursor -model gpt-6.1-sol

It prints the change to ~/.cursor/hooks.json as a diff (the project’s .cursor/hooks.json with -project, in a trusted workspace) and writes it only after you answer yes. Files you attach are sized as well. lockpin hooks uninstall -agent cursor takes it out.

To add it by hand:

{"version": 1, "hooks": {"beforeSubmitPrompt": [{"command": "lockpin hooks review -hook cursor -model gpt-6.1-sol"}]}}

The review checks prompts. It does not cap what Cursor spends: only the team server does that. The Cursor hook has been checked by Lockpin’s tests only, not yet in Cursor itself.

Models#

Only models with a price work. Others get HTTP 400 unknown_model; lockpin providers -models lists the priced ones. Cursor features that call endpoints Lockpin cannot meter, such as embeddings and files, are refused with HTTP 403 by design.

Verify#

After one chat request in Cursor, the meter on the team server shows a call on the task <key name>/default. If nothing arrives, Cursor’s servers cannot reach your Lockpin.