Cursor (Anysphere) — what the harness publishes

tl;dr: Anysphere does not publish the literal system prompt Cursor sends to Claude/GPT/Gemini/Grok. What’s public is the harness and model lineup. The 2024-11 reverse-engineered prompt is stale — model names, surfaces, and the agent split have all changed. This entry catalogs what is public, not the prompt.

Status of the “system prompt”

Cursor is proprietary — there is no system_prompt.md in the repo, no published prompt, and the 2024-11 leak is no longer accurate. The harness still routes per surface (inline completion, chat, agent/Composer, Cloud Agent), but the underlying prompts and tool schemas change frequently and are not public. The patterns the 2024 leak surfaced — mode-specific behavior, style mirroring, diff-first edits — still hold as behavioral shape; the literal text does not.

This entry does not invent a system prompt. It catalogs what Anysphere does publish.

What’s public

Models (2026-09)

Cursor runs two usage pools:

• Cursor Models — first-party, jointly trained with SpaceXAI: Grok 4.6, Grok 4.5, Composer 2.5 (plus their “Fast” variants). Significantly more included usage.
• Other Models — third-party, charged at API rate. Anthropic, OpenAI, Google, Moonshot, Meta, Z.ai.

Current third-party lineup (selected; full table on /docs/models):

First-party Composer 2.5 is the cheapest in-pool model at $0.5/$2.5 per MTok. Grok 4.6 is $2/$6 per MTok. Cursor Token Rate adds $0.25/M tokens on top of third-party model API pricing (Auto also routes through it for third-party picks); first-party Cursor Models are exempt.

Plans

Cursor Router (Auto)

Cursor Router only runs on Teams and Enterprise. Three modes, all exposed as auto-smart with optimize_for: cost | balanced | intelligence in the TypeScript and Python SDKs:

• Cost — previous Auto logic; optimizes token spend.
• Balance — intelligence / speed / cost tradeoff. Uses limits faster than Cost.
• Intelligence — frontier models for harder tasks at lower cost than pinning a single frontier model.

Enterprise admins can disable modes per team, set Soft vs Hard Auto default, and choose whether the routed model name is shown at the top of each response (default: hidden — Cursor argues results should be judged on their own merit). On Enterprise, the router respects model-access controls and routes to an allowed model instead; blocking too many models disables the router. Cursor Grok 4.5 must be enabled for the router to work — it’s the cost-efficient model the router falls back to when it’s not calling a frontier model. All Auto modes bill at the routed model’s list price; third-party picks also incur the Cursor Token Rate.

Agent surfaces (per Cursor’s recent changelog)

Cursor changelog (most recent first): 2026-09-02 Self-hosted machines · 2026-08-27 Start from scratch (no SCM) · 2026-08-19 Subscriptions + Custom Modes + subagents on their own machines + /goal · 2026-08-17 Origin code hosting · 2026-08-13 Builds for Cloud Agents.

Behavioral patterns worth borrowing (still hold from 2024)

Even without the literal prompt, three patterns from the 2024 reverse-engineering remain accurate today:

1. Mode-specific behavior. Inline (low temp, short diffs), chat (Cmd+L — explanations + @file), agent/Composer (multi-step planning + tool calls + verification), Cloud Agent (long-running, subscribes to PR/Slack events).
2. Style mirroring. The harness tells the model to match the file’s indentation, naming, and style rather than impose its own.
3. Diff-first edits. Composer emits targeted diffs, not full file rewrites, unless asked.

How to inspect Cursor’s behavior today

• Stream JSON — turn on in settings and capture the raw request/response per turn.
• /stats in chat — exposes token usage per turn.
• /model — confirms which model answered (and which auto-smart mode routed).
• /router (Teams/Enterprise) — shows the model Auto picked and the cost of that choice.
• Composer-2-5-fast — the explicit cheap/fast first-party tier; useful for isolating whether Composer itself is the variable in a behavior diff.

If you want a literal prompt to study, Claude Code publishes one — see Anthropic Claude — what Anthropic publishes.

Gotchas

• Don’t trust the 2024-11 prompt. Model lineup is completely different; harness surface has new products (Cloud Agents, /goal, Origin, Self-hosted machines).
• “Hidden by default” appears on most models. That row in /docs/models means the model is opt-in (advanced model picker), not auto-routed. Cursor ships it; it doesn’t surface it.
• Auto is not Router. When you select a model explicitly (e.g. “Claude Fable 5.1”), you bypass the router; Auto only kicks in when you select auto-smart.
• First-party Cursor Models bypass the Cursor Token Rate. Composer and Grok cost less to Cursor than to a third-party equivalent — that’s the value prop of the Cursor Models pool.
• Plans ≠ API. All Cursor-side model prices are pass-through API rates plus the Cursor Token Rate. Compare against the model’s own pricing page, not the previous Cursor entry.

Related

• Anthropic Claude — what Anthropic publishes — sibling “what’s public” entry on the prompts shelf
• code-review-system-prompt — a system prompt example on the prompts shelf
• design-system-checklist — design system rules reference on the prompts shelf
• Anthropic PDF (official skill) — cross-shelf: skills that pair with the harness