Your workspace.
Your rules.
Start in a disposable project. Verify a few small actions before granting access to real files.
1. Install and enable
In Cursor’s Extensions view, search ApprovalLens by ahmedhsn710. Install version 0.6.0 or newer. If your library is still cached, download the release VSIX and use Install from VSIX.
Open one trusted local folder on macOS/Linux. Create demo.txt containing hello world and sample-credentials.txt containing the synthetic text below. Never use real credentials for testing.
api_key="abcdefghijklmnop-demo-only"
Run ApprovalLens: Enable for this workspace. Confirm setup. The extension starts its bundled companion and adds project hooks, an MCP entry and a rules file. Cursor may require a new chat or trusting the MCP entry. No separate Node installation or terminal service is needed.
2. Apply a small policy
Run ApprovalLens: Edit rules, use this policy, save, then run ApprovalLens: Apply rules and confirm. Merely editing the file does not change active permissions.
{
"version": 1,
"taskId": "verification",
"developerIntent": "Inspect demo files and update demo.txt only. Preserve all other files.",
"shellInspection": true,
"grants": [
{
"operation": "read_file",
"path": "demo.txt"
},
{
"operation": "write_file",
"path": "demo.txt"
},
{
"operation": "read_file",
"path": "sample-credentials.txt"
}
],
"blockedTerms": [
"PROJECT-PRIVATE-CANARY"
]
}3. Verify behavior
Use a fresh Cursor agent chat. Ask it to make exactly the native tool call shown, with no fallback, shell wrapping or automatic retries. Tests need the actual tool call; a conversational answer is not interception evidence.
| Action | Expected result |
|---|---|
Native Read of demo.txt | Allowed locally; visible in activity. |
Native whole-file Write of demo.txt | Waits for your decision. Reject first, then repeat and approve once. |
Native Read of sample-credentials.txt | Blocked by sensitive-data detection despite the read grant. |
Native Write of other.txt | Blocked: no write grant. |
/bin/cat demo.txt | /usr/bin/wc -l | Allowed: supported read-only stages, granted file. |
/bin/pwd || /bin/cat other.txt | Denied: every branch is checked, including conditional reads. |
/bin/cat demo.txt > other.txt | Denied: redirection is unsupported. |
curl https://example.com | Denied locally: no network transfer adapter. |
For the write test, verify actual file content after both rejection and approval. Try a second chat and confirm its activity is grouped separately.
4. Optional hosted findings
Run ApprovalLens: Connect hosted review, accept the data disclosure and enter a privately supplied pilot token—not a Nebius API key. It is saved in editor SecretStorage. Setup checks authentication without spending a model call.
Hosted AI has a limited shared quota. Local policy checks work without a token. Required LIVE review failures deny the action; they do not silently switch to permission. No separate classifier model is used.
Troubleshooting and removal
Run ApprovalLens: Check setup and verify your version, workspace and running companion. Reload the window after upgrading. Shell inspection requires shellInspection: true and supported absolute executable paths; bare commands, scripts and unknown options are denied.
Run ApprovalLens: Disable for this workspace before uninstalling. It removes only owned hook/MCP entries and keeps rules and audit history. If already uninstalled, remove the ApprovalLens hook entries before using native tools again. Windows, remote and multi-root workspaces are not supported.