Introduction

Cursor is a powerful code editor that integrates AI directly into your workflow. I've been using it in several projects and honestly, it can be a game-changer, but only if you configure it correctly. In this guide, I'll show you how to set it up securely and efficiently.

Why is it important to configure Cursor correctly?

Configuring Cursor properly isn't just a matter of convenience. It's crucial for:

Security: Protecting your API keys and secrets
Productivity: Making the most of AI capabilities
Consistency: Maintaining code standards in your team
Control: Deciding what information to share with AI

Cursor Rules Configuration

Cursor Rules are instructions you give to the AI about how it should behave in your project. They're fundamental for maintaining consistency and quality. Cursor supports different types of rules: Project Rules, User Rules, Team Rules, and AGENTS.md.

Important note: The .cursorrules (legacy) file is being deprecated. I recommend using Project Rules in .cursor/rules or AGENTS.md for a simpler alternative.

Project Rules (.cursor/rules)

Project Rules are stored in .cursor/rules as markdown files and are version-controlled in git. They're scoped to your project and can be organized in folders.

Creating rules: You can create rules in two ways:

Use the New Cursor Rule command from the command palette
Go to Cursor Settings → Rules, Commands

This automatically creates a new rule file in .cursor/rules. From settings you can see all rules and their status.

Example rule in .cursor/rules/code-style.mdc:

---
description: "Code style standards and API validation"
alwaysApply: false
globs: **/*.ts, **/*.tsx
---

## Code Style
- Use strict TypeScript
- Follow this project's naming conventions
- Always include explicit types
- Use async/await instead of promises when possible

## File Structure
- Components in /components
- Utilities in /lib
- Types in separate .ts files

## Security
- NEVER include API keys, tokens, or secrets in code
- Use environment variables for sensitive configuration
- Validate all user inputs

## Testing
- Write tests for critical functions
- Use descriptive names for tests

AGENTS.md (Simple Alternative)

If you prefer something simpler, you can use AGENTS.md in your project root:

# Project Instructions

## Code Style
- Use strict TypeScript
- Follow this project's naming conventions
- Always include explicit types

## File Structure
- Components in /components
- Utilities in /lib
- Types in separate .ts files

## Security
- NEVER include API keys, tokens, or secrets in code
- Use environment variables for sensitive configuration

Rule Types

You can configure how rules are applied:

Always Apply: Applied to every chat session
Apply Intelligently: When Agent decides it's relevant based on description
Apply to Specific Files: When a file matches a specified pattern
Apply Manually: When you @-mention it in chat using @rule-name. For example, if you have a rule named code-style, you can type @code-style in chat to apply it manually.

Best Practices for Cursor Rules

Be specific: Instead of "write clean code", say "use descriptive names, small functions, and avoid deep nesting"

Include examples: Show the style you want:

# Example of a well-written function:
function calculateTotal(items: Item[]): number {
  return items.reduce((sum, item) => sum + item.price, 0)
}

Update regularly: As your project evolves, update the rules

Environment Variables Configuration

Never, ever, ever put API keys directly in your code. Use environment variables.

Create .env file

Create a .env file in your project root:

# API Keys
OPENAI_API_KEY=sk-your-key-here
ANTHROPIC_API_KEY=sk-ant-your-key-here

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/db

# Other secrets
JWT_SECRET=your-super-secure-secret

Configure .gitignore

Make sure .env is in your .gitignore:

# .gitignore
.env
.env.local
.env*.local

Load variables in your code

In Node.js/Next.js:

// lib/config.ts
export const config = {
  openaiApiKey: process.env.OPENAI_API_KEY,
  databaseUrl: process.env.DATABASE_URL,
}

// Validate that variables exist
if (!config.openaiApiKey) {
  throw new Error('OPENAI_API_KEY is not configured')
}

MCP (Model Context Protocol) Configuration

MCP allows Cursor to access external information in a controlled way. It's powerful but must be configured carefully.

What is MCP?

MCP is a protocol that allows Cursor to connect with external services like databases, APIs, or development tools. This gives the AI more context about your project.

Using ready-made MCP servers

The easiest way to get started with MCP is to use pre-built servers. Cursor has a directory of available MCP servers that you can install with one click.

To install an MCP server:

Go to the official Cursor's directory: https://cursor.com/docs/context/mcp/directory
Browse available servers or search for the one you need
Click "Add to Cursor" to install it directly
Configure any necessary credentials (API keys, tokens, etc.) using environment variables

Some examples of popular MCP servers include:

Databases (Supabase, PostgreSQL, etc.)
Cloud services (AWS, Azure, etc.)
Development tools (GitHub, Linear, Figma, etc.)
Documentation (AWS Docs, Astro Docs, etc.)

Security Considerations for MCP

Verify the source: Only install MCP servers from trusted developers and repositories
Review permissions: Check what data and APIs the server will access
Limit API keys: Use restricted API keys with minimal required permissions
Use environment variables: Never hardcode credentials in configuration
Monitor usage: Review what information the AI is accessing

Additional Security Configuration

1. Configure file exclusions

In Cursor settings, exclude sensitive files:

{
  "files.exclude": {
    "**/.env": true,
    "**/.env.local": true,
    "**/node_modules": true,
    "**/.git": true,
    "**/dist": true
  }
}

2. Configure context limits

Limit how much code the AI can see at once:

{
  "cursor.maxContextLength": 50000,
  "cursor.includePatterns": [
    "**/*.ts",
    "**/*.tsx",
    "**/*.js",
    "**/*.jsx"
  ],
  "cursor.excludePatterns": [
    "**/node_modules/**",
    "**/dist/**",
    "**/.next/**"
  ]
}

3. Use Cursor in safe mode

For very sensitive projects, consider:

Disable access to files outside the project
Use "Local only" mode when possible
Review what information is sent to models

Workspace Configuration

Per-project configuration

Each project can have its own configuration in .vscode/settings.json (Cursor uses the same structure):

{
  "cursor.model": "gpt-4",
  "cursor.temperature": 0.7,
  "editor.formatOnSave": true,
  "editor.codeActionsOnSave": {
    "source.fixAll": true
  }
}

General Best Practices

1. Review before accepting suggestions

AI can suggest code that looks correct but has issues. Always:

Review generated code
Run tests
Verify there are no security vulnerabilities

2. Use Cursor for repetitive tasks, not architectural decisions

Cursor is excellent for:

Generating boilerplate
Refactoring code
Writing tests
Documenting functions

Don't use it for:

Deciding your application's architecture
Choosing which libraries to use
Making business decisions

3. Keep your rules updated

As your project grows, update:

Rules in .cursor/rules with new patterns
File exclusions
MCP configurations

4. Collaborate with your team

Share best practices:

Add .cursor/rules to the repository (they're version-controlled in git)
Document special configurations
Establish usage standards

Common Mistakes and How to Avoid Them

Exposing API keys in code
- ❌ const apiKey = "sk-1234567890"
- ✅ const apiKey = process.env.OPENAI_API_KEY
Not configuring .gitignore
- Always verify that .env is in .gitignore before committing
Rules that are too vague
- ❌ "Write good code"
- ✅ "Use strict TypeScript, small functions (< 50 lines), and descriptive names"
Allowing access to sensitive files
- Review what files Cursor can read
- Exclude directories with sensitive information

Conclusion

Configuring Cursor correctly saves you time and prevents security issues. Take the time to:

Create rules in .cursor/rules or use AGENTS.md
Configure environment variables correctly
Review and limit MCP access
Set up exclusions for sensitive files

With these configurations, Cursor becomes a powerful and secure tool that truly improves your productivity.

Do you have questions about any specific configuration? Leave me a comment and I'll help you.

Was this resource helpful?

Related Resources

Tutorial: Introduction to LangChain