Local control.
Grounded advice.
ApprovalLens separates permission, evidence and interpretation. The model explains eligible actions. Your applied policy and your decision control the supported native approval boundary.
Request states and decisions
Approval is not proof of execution. The host reports the eventual outcome. In LIVE mode, an invalid or unavailable required review denies the request; it does not silently fall back to rules-only mode.
One extension. Two trust boundaries.
- 01Cursor delivers a native tool event
- 02Bundled hook sends it to the local companion
- 03Exact grants, constraints and sensitive-data checks
- 04Eligible action waits for review
- 05You approve or reject in Cursor
- 06State recheck, then permission returned to Cursor
- 01Local evidence is minimized and scanned
- 02Authenticated MCP request reaches Vercel
- 03NVIDIA Nemotron Super runs on Nebius Token Factory
- 04Structured findings are validated locally
- 05Findings inform your decision; the server cannot execute
Hard denials stop locally and skip inference. Ordinary supported reads can pass locally. LIVE review failures, invalid replies, timeouts and rejected decisions do not grant permission. Approval and the subsequent host-reported outcome are recorded separately.
Project rules, with a deliberate application step
- 01Detect stack from file names; exclude hidden and sensitive paths
- 02Automatically inventory eligible project paths and ask for task intent
- 03Preview the exact inventory before transmission
- 04Nemotron proposes minimal read/write grants with reasons
- 05Validate every grant against the automatically collected project paths
- 06Review draft, save rules, explicitly apply
No source contents or manifest contents are uploaded for suggestions. The inventory is bounded and skips symlinks and common generated directories. Existing restrictions are retained in the draft. Suggestions cannot introduce delete grants or enable shell inspection; active rules remain unchanged until explicitly applied. File names and task intent can still be sensitive, so preview them before sending.
What each component owns
| Component | Responsibility |
|---|---|
| Cursor extension · CommonJS | Workspace setup, sidebar, approval UI and editor SecretStorage. |
| Bundled local companion · TypeScript | Private Unix socket, tool normalization, trusted policy snapshot, pending decisions and bounded activity. |
| Shared core · TypeScript + Zod | Exact operation/path grants, shell analysis, JSON evidence, field constraints, egress inspection and output validation. |
| Hosted MCP · Next.js on Vercel | Stateless Streamable HTTP POST at /api/mcp. Authenticated evidence review and rule suggestions; public synthetic samples. |
| Nebius Token Factory | OpenAI-compatible inference using nvidia/nemotron-3-super-120b-a12b with structured JSON output. |
| Upstash Redis | Durable aggregate call reservations in capped mode. Explicit owner-configured uncapped testing mode bypasses this counter; authentication remains required. |
Evidence and data handling
Hosted action review receives task intent, agent explanation, paths and supported evidence. Raw write bodies are omitted. JSON field values are disclosed only through explicit policy schemas. Vercel receives client-observed evidence and cannot independently verify the local filesystem. Results are advisory and marked non-executable.
The companion validates model findings against its analysis. Exact field-preservation constraints are enforced deterministically; the model cannot override them. Arbitrary source-code behavior is not proven by this analysis.
- Workspace: editable rules plus owned Cursor hooks and MCP configuration.
- User state outside the project: applied policy, activity and the local socket.
- Editor SecretStorage: the hosted access credential.
- Vercel production secrets: Nebius API key, pinned model and access credential.
Supported operations and bounds
This release supports one trusted local workspace on macOS or Linux. Native Read, whole-file Write and Delete have adapters. Opt-in shell inspection recognizes selected literal read-only commands and checks every stage and branch against exact file grants.
Arbitrary scripts, package managers, redirects and network-capable shell operations remain unsupported. Search and other host paths may not deliver hook events. This is not an OS sandbox, universal interception or a zero-egress guarantee.
Hosted requests are bounded to 32 KiB. Inference uses a 45-second provider timeout and at most 1,800 output tokens. Required review failure denies the action. Pending native decisions expire rather than automatically approving.
Inspect the implementation
Source, tests and MIT license ↗ · Installation · Privacy · Evaluation guide