Cursor Live Apps, announced on November 5, 2026, lets a cloud agent build a web app from a plain-language description, provision a Postgres database, put sign-in behind Cursor SSO, and publish it at a live link (Cursor changelog). For internal tools it beats self-hosting, because the security gate and admin controls cover work most teams skip. For customer-facing apps, self-hosting still wins: Cursor has not published hosting or database quotas, regions or a provider name (Data Studios).
TL;DR
- Live Apps moves the last mile (hosting, database, auth, security review) inside the coding tool.
- It only works through a cloud agent, not locally (Cursor docs).
- Four security checks are always on, and admins cannot remove them.
- It needs a paid plan with cloud agents, which starts at Premium.
- Pick it for internal dashboards and demos. Skip it for customer-facing production until limits and regions are published.
What are Cursor Live Apps and how do they work?
Cursor Live Apps is a feature of Cursor's cloud agents, listed in the docs simply as "Apps". The agent scaffolds the web app, creates a Postgres database if needed, sets up authentication behind Cursor SSO, and provisions hosting. At publish time you choose a unique domain and receive a live link. Repositories on Cursor Origin and GitHub are supported, and GitLab is listed as coming soon (Cursor changelog). Independent write-ups matched the launch the same day, from AICoder and TPS Report.
One limit is explicit: use a cloud agent, because the feature is not supported locally (Cursor docs). For background on the surrounding platform, see our Cursor Origin review.
How do you build and publish a live app in five steps?
- Open a cloud agent session, not a local one.
- Describe the app and say you want an app. An illustrative prompt: "Build an app where staff book desks by day, store bookings in Postgres, and restrict access to our company sign-in."
- If the app must reach your own systems, such as a data warehouse, Cursor prompts for the secrets. The agent never sees the values, and personal and team secrets are managed in the Apps dashboard (Cursor docs).
- Run publish. Deterministic and agentic security checks run first. If one fails, the agent lists what to fix, and nothing goes live until the checks pass and you explicitly publish (Cursor changelog).
- Pick the unique domain and share the link. On Teams and Enterprise, public sharing is disabled by default (Cursor docs).
Scripts and CI jobs can also call a published app with a personal or team API key sent in the x-cursor-app-token header. Those requests are marked as automated and identify the key, never a person (Cursor docs).
What security checks run before a Live App goes live?
Four checks are mandatory and always on (Cursor docs):
- Secrets written in app files are blocked.
- Credential files such as private keys, service-account keys and auth-token files are blocked.
-
.envfiles are never published. - Source maps are never published.
On top of those, an AI security review reads the app's files and blocks serious issues. Admin custom instructions can add rules but cannot remove the built-in four. Team admins can see every app and secret, approve publishes the review blocked, and unpublish any app. The exceptions are malicious code, hardcoded secrets and exposed credentials, which admins cannot approve. All changes go to the team audit log (Cursor docs).
That is the strongest argument for the feature: a hand-rolled internal tool rarely gets a source-map check, an audit log or a central unpublish switch.
Which plans include Cursor Live Apps, and what does it cost in rupees?
Live Apps needs a paid plan with cloud agents (Cursor changelog); prices come from Cursor pricing, with the eligibility reading from Data Studios.
| Plan | Price per month | Live Apps |
|---|---|---|
| Free | $0 | No cloud agents, not available |
| Plus | $8 | No cloud agents, not available |
| Premium | $30 | Available (entry plan) |
| Super | $100 | Available |
| Ultra | $200 | Available |
For readers in India, the rupee closed at 93.91 per US dollar on November 7, 2026 (Times of India). At that rate Premium at $30 is about Rs 2,817/month, and Super at $100 about Rs 9,391/month, before card fees and taxes.
Cursor Live Apps vs self-hosting: which should you pick?
| Question | Live Apps | Self-hosting |
|---|---|---|
| Time from idea to link | One agent session plus a publish step | Repo, infrastructure, database, auth and deploy pipeline to assemble |
| Security review | Built in, four checks always on | Whatever your team builds or remembers |
| Access control | Cursor SSO, admin unpublish, audit log | Your own identity provider and logs |
| Region and provider choice | Not published | Yours to choose |
| Quotas and cost at scale | Not published | Known and negotiable |
| Git host | Cursor Origin and GitHub | Anything |
Cursor's own examples — event-registration, account-assignment and desk-seating ops tools, customer demos, onboarding material, sales dashboards and engineering portals — were built by its sales, operations, legal, finance and engineering teams (Cursor changelog). All are low-traffic and behind sign-in, where opaque hosting does the least harm.
The verdict: use Live Apps for internal tools and demos. For anything customers depend on, keep your own hosting, where you control regions, scaling and costs. Weighing agent tools first? Our Antigravity vs Cursor vs Claude Code comparison and the OpenHands, Devin, Cline and Cursor verdict cover that, and OpenAI Codex as an autonomous worker shows a different way to delegate.
What has Cursor not disclosed about Live Apps?
Cursor has not published storage or traffic pricing or quotas for hosting and databases, has not named the hosting provider or regions, and gives no size limit for the auto-provisioned Postgres databases (Data Studios). Until those appear, you cannot size a workload, answer a data-residency question, or estimate cost beyond the plan fee.
The changelog moved fast around the launch: voice chat on 6 November, Live Apps on 5 November, the Agent SDK on 20 October, cloud-agent canvases and an Environments API on 16 October, and an Origin App Marketplace with more than 20 integrations on 13 October (Cursor changelog).
Why cover Cursor Live Apps at all?
Search volume is not the reason for this page: among 694 keywords measured by our DataForSEO pull (DataForSEO) on November 5, 2026, only 72 (10.4%) cleared a winnable bar of 150 to 6,000 monthly searches (n=694, measured 2026-11-05), so we cover this because it moves a real task — shipping a small internal app — into the tool most developers already keep open.
FAQ
Q: What are Cursor Live Apps?
A: A cloud agent feature that builds a web app from a plain-language description, sets up Postgres and Cursor SSO sign-in, hosts it, and returns a live link after security checks pass (Cursor changelog).
Q: Can I use Cursor Live Apps from a local agent?
A: No. The docs state that you must use a cloud agent and that the feature is not supported locally (Cursor docs).
Q: Which Cursor plans include Live Apps?
A: Paid plans with cloud agents. Free and Plus have no cloud agents, so Premium at $30 a month is the entry point, followed by Super at $100 and Ultra at $200 (Cursor pricing).
Q: Does the agent see my secrets or API keys?
A: No. When an app needs secrets for your own systems, Cursor prompts you for them and the agent never sees the values (Cursor docs).
Q: Can an admin override the security checks?
A: Admins can add rules and approve publishes the AI review blocked, but not for malicious code, hardcoded secrets or exposed credentials. The four built-in checks cannot be removed (Cursor docs).
Q: Is it ready for customer-facing production apps?
A: Not yet in our view. Hosting and database quotas, regions and the hosting provider are unpublished, and GitLab support is still listed as coming soon (Cursor changelog).
Top comments (0)