Cursor Now Hosts the Apps Its Agent Builds: How Build Live Apps Works, and the Catch

Cursor's own changelog says it plainly: "most apps and tools that users build never make it off of localhost." On November 5, 2026, Cursor shipped Build Live Apps to change that. You ask a cloud agent for an app, and Cursor builds it, sets up a database if it needs one and sign-in, hosts it and gives you a link.

What Build Live Apps does

Start a cloud agent and tell it explicitly that you want to build an app. The feature doesn't run in a local agent. From there, per Cursor's changelog, Cursor will:

• scaffold the web app
• spin up a Postgres database if the app needs one
• set up authentication behind Cursor SSO
• provision hosting

If the app has to reach your own systems, like a data warehouse, Cursor asks you for the secrets it needs, and the docs say the agent never sees the values. When you publish, you pick a unique URL (you can change it later) and Cursor hands back a live link. It can start from scratch on a new Cursor Origin repo or deploy an existing GitHub repo. Cursor says GitLab support is coming soon.

Cursor's docs give sample prompts like "Build an app that shows our weekly signups as a dashboard, with a chart and a table I can filter by plan" and "Deploy this repo as an app." Inside Cursor, the changelog says, people across sales, operations, legal, finance and engineering build internal apps with it. Some of the most useful: internal ops tools, customer presentations, onboarding for new hires, sales pipeline dashboards and engineering service portals.

The publish gate

Nothing goes live until you click publish and the checks pass. Four checks are always on, even when the AI review is off:

1. Block secrets written in app files (API keys, access tokens).
2. Block credential files (private keys, service-account keys, auth-token files).
3. Never publish .env files.
4. Never publish source maps, so visitors can't read the original source.

On top of those, an AI security review reads the app's files and blocks serious issues. If a check fails, the agent tells you what to fix. Team admins can add their own review rules, see every app and secret on the team, unpublish any app, and approve a publish the review blocked, except for malicious code, hardcoded secrets or exposed credentials.

Who can open your app

• People you invite: specific teammates or groups, signed in to Cursor.
• Team: your whole Cursor team, signed in.
• Public: anyone with the link. Individual plans can do this. On Teams and Enterprise, public sharing is off by default until an admin turns it on.

Scripts and bots can open apps they're allowed to access with a Cursor API key sent in the x-cursor-app-token header on every request (admins can turn this off).

What it costs

Apps is available on all paid plans with cloud agents. On Cursor's pricing page, cloud agents start at Premium, $30 a month. Free ($0) and Plus ($8 a month) don't include them. Super is $100, Ultra is $200, and Teams starts at $30 per user a month. Third-party models are billed separately at API list price. The pricing page lists no separate price for hosting the apps.

The catch

• You need a paid plan with cloud agents, and the pricing page lists no separate price for hosting the apps.
• Team apps always need Cursor sign-in. Public links are a separate option, off by default on Teams and Enterprise until an admin turns them on.
• Cursor's terms apply to the hosting. The docs say hosting is provided "as is" and "as available," and that published apps may be removed or suspended for policy, business, financial or legal reasons.
• Checks catch common issues. The four built-in checks are a gate for secrets and leaks, and the AI review looks for serious issues, so you still review what the app does with real data.

Here's how you get paid

My opinion, no income guaranteed: a team that already pays for Cursor can now get small internal tools without setting up its own hosting. Offer one of them an internal-tools day:

1. Sales dashboard. Pipeline and opportunities from their own data, connected through team secrets their admin controls.
2. Onboarding portal. One place for a new hire's first week.
3. Publish and hand off. Ship both inside their Cursor account, behind their sign-in, and show their admin where to see and unpublish every app.

To build inside their account you'd likely need to be on their Cursor team (check with their admin), so agree on that access first. Tell them up front what the checks cover, so the handoff is honest about what still needs a human review.