DEV Community

Cover image for Cursor Finished the Turn Blind — MCP write tool gated live on the Travel Path
Moshe Avdiel
Moshe Avdiel

Posted on Originally published at github.com

Cursor Finished the Turn Blind — MCP write tool gated live on the Travel Path

I have sat next to the travel-coordinator wall at 18:45 while Cursor was this close to doing the wrong thing.

Not a model failure. A posture failure.

The host had started with tools-allow frozen in env / argv / a skill file. Someone on the floor said, out loud, mute writes on the noisy room — keep reads. Cursor was still holding the old process. The only “safe” move anyone trusted was:

  1. Kill Cursor (or its MCP server)
  2. Edit a file
  3. Restart the host
  4. Lose the overbook thread the agent already paid for

I have watched that restart more times than I want to admit. It feels responsible. It is a ceremony. group-chat flood during a GDS blip does not wait for ceremonies.

The Aha: MCP write tool gated live is not a binary you reboot. It is a function that should read live posture from Kiponos.io on every call. The host stays up. The leaf moves.

The problem: MCP write tool gated live lived in the process, not in the turn

Cursor is good at calling tools. It is not born with a shared, instant, restart-free control plane.

So teams hide MCP write tool gated live in the only places agent frameworks actually ship:

Where the gate hid What you restart What you lose
MCP server env / argv The MCP process Open tool sessions
Skill file on disk The agent turn, sometimes the host Context the model already paid for
Host-local JSON Whatever still has the file open Agreement between two agents
Hard-coded if on tools-allow A release The incident clock

The travel-coordinator wall already knew. Cursor did not, because it had started earlier.

That is the missing piece: the framework gave you tools. It did not give you a live hub.

What teams believe

Belief Production
Put the SDK in the SPA Connect tokens do not belong in a browser
Feature flags cover this Flags are another product, another delay
Paste the new tools-allow into chat Two agents, two pastes, two lies
We'll catch it next turn The travel-coordinator wall already knew this turn

The Aha: local get, live write, host stays up

Kiponos holds a nested tree. Java and Python SDKs keep the latest values in memory, patched over WebSocket deltas. The hot path inside a Cursor tool is a local get — no HTTP RTT per travel lookup.

Hub leaf for this essay:

examples/agentic-dev-1101-pm-mcp-gate/tools-allow = search,read
Enter fullscreen mode Exit fullscreen mode

Runnable proof: examples/java/agentic-dev-1101-pm-mcp-gate

Public SDKs: Java, Python, plus React/Angular server peers (createFromEnv). Never put Connect tokens in the SPA.

Config tree (travel + peers) 

examples/
  agentic-dev-1101-pm-mcp-gate/
    tools-allow: search,read          # MCP write tool gated live
apps/
  travel/
    live:
      tools-allow: search,read
Enter fullscreen mode Exit fullscreen mode

Integration — Java hot path 

Kiponos kip = Kiponos.createForCurrentTeam();
Folder gate = kip.getRootFolder()
        .folderOrCreate("examples")
        .folderOrCreate("agentic-dev-1101-pm-mcp-gate");
if (!gate.hasKey("tools-allow")) {
    gate.set("tools-allow", "search,read");
}
String posture = gate.get("tools-allow");
// Cursor tool: refuse the dangerous call when posture moved
Enter fullscreen mode Exit fullscreen mode

Same leaf from a Python tool (Cursor just calls it):

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)  # env: KIPONOS_ID, KIPONOS_ACCESS, KIPONOS
try:
    posture = k.get("examples/agentic-dev-1101-pm-mcp-gate/tools-allow", "search,read")
    if str(posture) == "search,read":
        raise PermissionError("MCP write tool gated live gated live — host not restarted")
finally:
    k.disconnect()
Enter fullscreen mode Exit fullscreen mode

The Cursor process does not recycle. The next tool call already sees the dashboard edit.

Real scenarios

Event Without Kiponos With Kiponos
Group-chat flood during a gds blip Restart Cursor; lose the overbook thread the agent already paid for Set tools-allow live; next Cursor tool call already obeys
Peer host still on old tools-allow Paste the value into the other chat One hub leaf; both processes get() locally
travel-coordinator wall shows the new posture Cursor started earlier so it writes anyway Dashboard and tool share the same memory tree
Incident over, resume Another Cursor restart Set tools-allow back; session continues
Shopping admin still mutating stock mid-freeze Two ceremonies, two lost threads Same tree, two products, no paste

Performance (this path, not a generic table)

  • Cursor tool get() is an in-process map lookup after bootstrap.
  • One WebSocket per process lifetime — not per travel line.
  • A dashboard edit is a delta of tools-allow, not a config-file reload.
  • You do not pay model tokens to “please restart Cursor.”
  • A second host converges without a third paste onto shopping admin still mutating stock mid-freeze.

Compare to alternatives

Approach Honest fit Why it still restarts
Env file + Cursor reboot Simple at 09:00 The freeze is at 18:45
Skill markdown as policy Good instructions Not a live bus
Redis poll inside the tool Shared, but RTT on the hot path You invented a hub with worse UX
Feature-flag SaaS Product experiments Rarely session-safe for Cursor
@RefreshScope / actuator JVM apps Does not restart Cursor

When not to use Kiponos

Situation Why
Tool schema itself changed (new argument) That is a code/Cursor restart
Secret rotation of Connect tokens Credentials are not live knobs
One-off local script, no peers A hub is overkill
Browser-only “SDK in the SPA” Forbidden — tokens leak or defaults lie

Pair tools-allow with a sister dial

tools-allow rarely moves alone on the travel-coordinator wall. Pair it with a timeout, a mute, or a pause so you do not fix MCP write tool gated live by inventing a second incident.

Rehearsal beats slides

In staging: set a painful tools-allow, prove Cursor recovers without a host kill, prove clamps reject nonsense, prove last-known-good when the hub is firewalled. That drill ends half the architecture arguments about MCP write tool gated live.

Why Cursor is the wrong restart target

Cursor is good at calling tools. It is not a control plane. Killing it to flip tools-allow teaches the on-call that judgment requires a process ID. The travel-coordinator wall already disagrees.

Getting started (15 minutes)

  1. TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
  2. Clone github.com/kiponos-io/kiponos-io.
  3. cd examples/java/agentic-dev-1101-pm-mcp-gate && cp kiponos.local.env.example kiponos.local.env
  4. ./gradlew test run — prints examples/agentic-dev-1101-pm-mcp-gate/tools-allow=...
  5. In the dashboard, change tools-allow. Keep the process up. No rebuild.
  6. Point your Cursor tool at the same leaf. Do not ship a new server binary to flip MCP write tool gated live.

Further reading

The moral

If flipping MCP write tool gated live requires restarting Cursor, you do not have a gate. You have a hope with a process ID.

Agent frameworks already know how to call tools. Kiponos is the live hub they do not ship — so the travel-coordinator wall can change its mind without killing the session.

How to try: examples/java/agentic-dev-1101-pm-mcp-gate and ./gradlew test.

Top comments (0)