Cursor Will Host Your App Now, and Free Plans Cannot Use It
An IDE quietly became a hosting platform, and the free tier stopped at the door for the second time in a month.
Cursor shipped live apps on 5 November 2026. A cloud agent can scaffold a web app, provision a Postgres database, set up authentication behind Cursor SSO, provision hosting and hand back a published URL. Cursor states the capability is available on all paid plans with cloud agents enabled, so Copilot-style free users cannot publish anything. Apps deployed by an individual plan can also be shared publicly.1
This is a larger change than a feature update. An editor that used to write code now runs the server, the database and the login for whatever it produces, and the customer never leaves the session.2
What Cursor provides
| Component | How it works |
|---|---|
| Hosting | A dedicated account created per team, isolated from every other team's and user's |
| Database | Postgres provisioned automatically when the app needs one |
| Auth | Private and team apps sit behind Cursor sign-in; individual plans can share publicly |
| Secrets | Prompted for during the build; the agent never sees the values |
| URL | You pick the subdomain at publish, and it can be changed later |
| API access | Cursor API keys open apps via an x-cursor-app-token header |
Prices measured on 27 October 2026. Vendor plan terms, allowances and prices change without notice, so treat every figure on this page as a dated snapshot rather than a permanent fact. Where a number here differs from the vendor's own pricing page, the vendor's page is correct and the figure above is simply older than it.
The hosting isolation claim is specific and worth noting. Each app lives in a dedicated account Cursor creates, rather than sharing a multi-tenant pool. That is the kind of detail that matters when the app is internal and the data is not public.
The four checks that always run
Publishing is gated, and four of the checks are not optional even when the broader security review is turned off. Cursor blocks secrets written into app files, blocks credential files including private keys and service-account keys, never publishes .env files, and never publishes source maps.
On top of those, an AI security review reads the app's files and blocks serious issues before anything goes live. Team admins can add their own instructions to that review prompt, and Cursor is explicit that custom instructions can add rules but cannot remove the built-in checks. Admins can approve a publish the review blocked, with three exceptions: malicious code, hardcoded secrets and exposed credentials.
Nothing goes live until the person who built it chooses to publish. A failed check lists what needs fixing, the agent is told to fix it, and the publish is retried.
Where the free tier stops
Apps are available on paid plans with cloud agents enabled. That is the second time in a month the Cursor free tier has been positioned on the outside of a launch, and it follows the pattern set on 12 November when GPT models leave Cursor entirely for users who have not paid.
The practical consequence for anyone on Free is narrower than it sounds. Free users keep the editor and the completions; they cannot hand a build to a cloud agent and get a URL back. For a solo developer testing an idea, that is the difference between a prototype they can show someone and one that only runs on their laptop.
The cheapest route in is the $10 Pro plan rather than the $8 Plus tier, because Plus is restricted to Grok models and the whole point of this feature is an agent capable enough to build and fix its own app.
Why hosted apps are the logical end of the cloud agent
Cursor's own framing is blunt: agents have lowered the cost of writing code, and most apps and tools that users build never make it off localhost. That is the gap this fills, and it is a real one. The last mile of any internal tool has always been the deploy, the database and the login, and those three are where weekend projects die.
It also changes what an IDE subscription is for. A $10 to $100 editor licence that also provides hosting, a database and auth is competing with a Vercel or Netlify subscription at the low end, and with an internal platform team at the high end. Cursor lists the internal uses its own staff have built: event registration, account assignments, desk seating, sales pipeline dashboards, onboarding experiences.
Those are exactly the tools that previously required a developer, a ticket and a quarter of waiting. A team member describing one to an agent and getting a URL back is a different procurement conversation, and it is why the paid-plan restriction is unlikely to move.
What to check before you publish
Public sharing is off by default for Teams and Enterprise. An admin turns it on in the Apps dashboard, and turning it off again moves existing public apps back to team visibility.
Decide who can use keys. Admins can allow or disallow API keys opening apps. A key that is not permitted is treated like a user with no access, so the caller is redirected to sign in rather than receiving data.
Remember the key only travels as a header. There is no query parameter and no cookie. Tools that cannot set an x-cursor-app-token header cannot reach a private app at all, which rules out a fair number of integrations that only accept a URL.
Check the terms. Cursor states that hosting is separate from its services and provided as is, that publication is not endorsement, and that a subdomain or published app can be suspended or removed for policy, business, financial or legal reasons. For anything load-bearing, that is not the same guarantee as a dedicated host.
Frequently asked questions
Can I use Cursor live apps on the free plan?
No. Apps require a paid plan with cloud agents enabled.
Where are the apps hosted?
In a dedicated account Cursor creates for your team, isolated from other teams and users.
Does it include a database?
Yes. Cursor provisions a Postgres database automatically when the app needs one.
Who can open a private app?
Only people signed in to Cursor who have been given access, either individually, by group, or as an entire team.
Can a script or bot reach a private app?
Only with a Cursor API key sent in the x-cursor-app-token header. Query parameters and cookies do not work.
Which security checks always run?
Blocking secrets in app files, blocking credential files, excluding .env files, and excluding source maps. The AI security review runs on top of those.
The 5 November 2026 release, hosting and database provisioning, Cursor SSO authentication, secret handling, the x-cursor-app-token header only, the four mandatory publish checks, admin controls, public sharing defaults, paid-plan availability and the hosting terms verified in Cursor's changelog entry and its Cloud Agent Apps documentation, both read on 9 November 2026.
Sources
- Cursor Changelog: Build Live Apps in Cursor, 5 November 2026: cursor.com/changelog/build-live-apps. Used for: The release, hosting and Postgres provisioning, Cursor SSO auth, secret handling, public sharing on individual plans and paid-plan availability.
- Cursor Docs: Cloud Agent Apps: cursor.com/docs/cloud-agent/apps. Used for: Isolated hosting accounts, the x-cursor-app-token header, the four always-on publish checks, admin controls and the hosting terms.
All sources are the vendor's own plan or documentation pages, checked on 27 October 2026. Plan terms change without notice, so confirm current limits before you rely on them.
