A narrow, local-first control plane.

Connection model

The Cursor extension starts a local WebSocket server and opens a temporary Cloudflare tunnel. Internet traffic uses the tunnel's TLS connection. On the same network, the app can use a faster token-authenticated LAN connection.

The optional LAN path currently uses unencrypted ws:// traffic. Use it only on a network you trust. Every tunnel and LAN connection requires the same bearer token.

Pairing and access

A random high-entropy token is encoded in the pairing QR code. The Android app normally encrypts pairing details with AES-256 through Android Keystore. If encrypted storage cannot recover, credentials remain process-local and are not persisted; the user signs in or pairs again after restart. The desktop side uses Cursor or VS Code secret storage.

Current releases require both the pairing token and a signed-in FireCursor account. Android obtains a five-minute, single-use extension capability from Supabase over HTTPS. The extension redeems it over HTTPS and never receives the user's Supabase session token.

Treat the QR code and pairing token like a password. Account checks reduce unauthorized reuse but do not make a shared pairing code safe.

Workspace boundaries

• Remote file and git operations are real-path checked and confined to the open workspace and supported Cursor worktrees.
• Files under .git are denied to the remote file browser.
• Prompts are passed through the selected provider's supported local interface without shell command reconstruction by FireCursor.
• Uploads are limited to 10 MB and stored inside .firecursor/attachments in the workspace.

Agent-provider processing

FireCursor keeps workspace operations on your computer. Cursor, OpenAI Codex, or Anthropic Claude may still process prompts, source context, tool results, and model output under the account, plan, and privacy settings you use with that provider. FireCursor does not change those service boundaries.

Codex authentication remains owned by the official app-server and its managed ChatGPT browser flow. Claude subscription authentication remains owned by Claude Code; FireCursor strips API and cloud-provider overrides from subscription Channel sessions and never receives the subscription credential.

Claude Code and Cowork require Claude Pro, Max, or an eligible organization plan. The optional Anthropic API fallback is billed separately. Claude Desktop handoffs open separate, user-reviewed sessions that are not mirrored into FireCursor.

Review and recovery

Each FireCursor session starts with a git-tree checkpoint, including untracked files without modifying your real index. Diff review and Undo All compare against that checkpoint. Undo creates a safety snapshot first, but it is not a substitute for your own backups or version control.

Report a concern

Send a concise reproduction and affected version to hello@firecursor.com. Do not include pairing tokens, credentials, private source code, or unredacted workspace paths.