To use Claude Code or Cursor securely, keep approval prompts on, turn on sandboxing or workspace trust, connect only vetted MCP servers, keep secrets out of the agent's reach, and scan every change before it merges. Both tools ship these controls, but several are off by default or limited, so check each one.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Everything about Claude Code and Cursor below is as of 19 October 2026.
Key takeaways
- Both tools ask before risky actions by default. Keep it that way.
- Claude Code's sandbox is off by default. Cursor's workspace trust is disabled by default.
- Neither vendor security-audits MCP servers for you.
- Your own review and scans remain the final check.
What are the default protections in Claude Code?
Claude Code in Manual mode starts read-only and asks before edits, tests and commands. It runs a built-in set of read-only commands such as ls, cat and git status without asking. Commands that fetch web content, such as curl and wget, are not auto approved by default. In an interactive session it shows a workspace trust dialog for folders you have not trusted, and project servers from .mcp.json get their own approval prompt.
Its documentation also notes that auto mode uses a separate classifier model to review actions instead of you. If you choose that mode, you are trusting the classifier, so decide deliberately.
What are the default protections in Cursor?
Cursor asks for manual approval of sensitive actions by default. Reading files and searching code do not need approval. Terminal commands need approval by default, each MCP tool call needs individual approval, and agents cannot make arbitrary network requests with default settings. Configuration files such as workspace settings need your approval before the agent changes them.
Cursor says Run Modes are best-effort guardrails, not a hard security boundary. Workspace trust is disabled by default. When enabled, it asks you to choose normal or restricted mode for new workspaces. The setting is security.workspace.trust.enabled.
Which settings should you change?
| Setting | Claude Code | Cursor |
|---|---|---|
| Command approval | Manual mode asks first | Terminal commands need approval by default |
| Sandboxing | /sandbox or sandbox.enabled, off by default | Not described on the agent security page |
| Network | Sandbox proxy with an empty allowed domain list | Agents cannot make arbitrary network requests by default |
| Untrusted repos | Workspace trust dialog | security.workspace.trust.enabled, disabled by default |
| Keep files from the agent | Permission deny rules | .cursorignore |
| MCP | Approval for .mcp.json servers, managed MCP configuration | Approval for each tool call, allowlists |
| Data handling | Privacy settings and retention limits | Privacy Mode, available on free and Pro |
How do you keep secrets away from the agent?
Block the files and keep credentials out of the environment. In Cursor, use .cursorignore to block agent access to specific files. In Claude Code, add deny rules for files and for network commands. Its sandbox can also mask credentials so sandboxed commands see a placeholder instead of the real value.
Whatever the tool, keep production credentials out of the project folder and use read-only or narrowly scoped tokens for anything the agent needs.
How do you handle MCP servers?
Treat each one as code you are installing. Claude Code's documentation says Anthropic does not security-audit or manage any MCP server, and Cursor's says to install servers only from trusted developers and use restricted keys. Follow how to vet an MCP server before installing and the practices in best MCP server security practices for developers.
How do you check what the agent wrote?
Add security review in the loop and in CI. Claude Code offers a security guidance plugin, installed with /plugin install security-guidance@claude-plugins-official, which reviews the agent's own changes, and a /security-review command for the current branch. Its documentation says these are layers, not a complete solution, and that CI scanners still do work the plugin does not attempt.
Safeguard has IDE extensions for VS Code, JetBrains and Cursor through Open VSX, and a free in-browser dependency scan at gold.safeguard.sh/scan. See how to scan AI generated code for the full set.
Checklist
- Approvals on, allowlist narrow
- Sandbox enabled, or work inside a container or VM
- Workspace trust on for untrusted repos
- Secret files blocked, tokens scoped
- MCP servers vetted and listed
- Every change scanned before merge
- Production access kept away from the agent
Frequently asked questions
Is Claude Code safe to use?
It has a permission system, sandboxing and trust prompts. The documentation says no system is completely immune, so keep reviewing what it proposes.
Is Cursor safe to use at work?
Cursor publishes SOC 2 Type II, ISO 27001 and other certifications on its security page, and Privacy Mode prevents training on your data when enabled. You still control approvals and MCP choices.
Does the Claude Code sandbox cover everything?
No. It covers shell commands. File tools, MCP servers and hooks run outside it.
Should I auto approve commands to save time?
Only inside a sandbox or disposable environment. Outside one, a single injected instruction can run with your account's access.
Sources
- Claude Code security documentation: https://code.claude.com/docs/en/security
- Claude Code sandboxing documentation: https://code.claude.com/docs/en/sandboxing
- Claude Code MCP documentation: https://code.claude.com/docs/en/mcp
- Claude Code security guidance plugin: https://code.claude.com/docs/en/security-guidance
- Cursor agent security documentation: https://cursor.com/docs/agent/security
- Cursor MCP documentation: https://cursor.com/docs/mcp
- Cursor security page: https://cursor.com/security
Last reviewed: 19 October 2026.
