> ## Content Index > Fetch the complete content index at: https://www.tao.media/llms.txt > Use this file to discover other available public pages before exploring further. # Cursor Launches Live Apps With Agent-Built Hosting, Databases, and Team Sharing - URL: https://www.tao.media/cursor-launches-live-apps-with-agent-built-hosting-databases-and-team-sharing/ - Published: 2026-11-08T03:54:14.000Z - Updated: 2026-11-08T03:54:15.000Z - Description: Cloud agents can now turn internal-tool requests into hosted web apps with built-in authentication and a security review before publication. - Author: Bart Hillerich - Tags: Cursor, AI, News Cursor has [launched Live Apps](https://cursor.com/changelog/build-live-apps?ref=tao.media), allowing its cloud agents to build web applications, provision databases, configure authentication, and deploy them to a shareable URL. The feature is available on all paid plans with cloud-agent access. The release brings the infrastructure needed to run an internal tool into the same workflow used to create its code. A user can describe a dashboard, portal, or registration system, then preview and publish the result without separately setting up hosting, a database, and a sign-in system. 0:00 /0:24 1× ## From a Prompt to a Hosted Application To start, users launch a cloud agent and ask it to build an app (local agents do not support the workflow). Projects can begin in a new repository on Cursor Origin or use an existing Cursor Origin or GitHub repository. Support for GitLab and other Git providers is planned. The agent then scaffolds the web application and provisions a Postgres database when the project needs persistent storage, and Cursor also sets up authentication and hosting. Each app is deployed in a dedicated hosting account created for the team, or for the user on an individual plan, with accounts isolated from those belonging to other teams and users. Once the app is ready, Cursor presents a tray for previewing and publishing it. The user chooses its URL, which can be changed later, and starts the publish process. If security checks identify a problem, the agent lists the issues to fix before another attempt. Cursor's [launch post](https://x.com/cursor%5Fai/status/2118458629091426304?ref=tao.media) focuses on getting agent-built tools beyond localhost, the developer's own machine, and into a form other people can use. The company reports that its sales, operations, legal, finance, and engineering teams are already building internal apps. Examples include event-registration and desk-seating tools, customer presentations combining slides with video and interactive demos, onboarding programs, sales-pipeline dashboards, and portals for managing engineering services. These are browser-based tools that colleagues can open through a link rather than run from a development environment. ## Security Checks Before Every Publish Cursor's [Apps documentation](https://cursor.com/docs/cloud-agent/apps?ref=tao.media) separates mandatory publishing checks from an additional AI security review. Four built-in checks remain active even when that review is turned off. Two block publication when app files contain hardcoded secrets or credential files, such as API tokens, private keys, or service-account keys. The other two exclude .env files from deployment and remove source maps, which can expose the original application source code to visitors. An AI security review also reads the app's files and blocks serious issues before publication. Team administrators can add instructions to its review prompt, but those instructions cannot remove Cursor's built-in checks. Administrators can approve publishes blocked by the review, with exceptions for malicious code, hardcoded secrets, and exposed credentials. They can also see every app and secret on the team and unpublish any app through the dashboard. The controls extend beyond individual deployments. Administrators can turn Apps on or off for the team, allow or disallow public apps, and decide whether API keys may open apps. Disabling public sharing moves existing public apps back to team visibility. Changes to these settings are recorded in the team's audit log. ## Sharing With Colleagues and Automated Tools Published apps can be shared with specific team members and groups or opened to an entire Cursor team. Private and team apps remain behind Cursor sign-in. Individual-plan users can also publish apps that anyone with the link can open without authentication. Public sharing is disabled by default for Teams and Enterprise. An administrator can enable it through the Apps dashboard, giving organizations a separate control over whether an internal tool can become publicly accessible. Cursor API keys provide access for scripts, CI jobs, and Grok Bot without requiring an interactive sign-in. Personal keys can open the apps their owner can access; team keys can open only the team apps explicitly made available to them. Automated clients must send the key in the `x-cursor-app-token` HTTP header on every request. Keys are not accepted through a query parameter or cookie, and requests identify the key rather than a person. This gives a published app a way to serve automated workflows as well as colleagues using a browser.