Give Cursor's AI agent safe SSH access to your servers

Cursor’s agent is comfortable in a repo. The moment the task leaves the repo — check why the service won’t start, run the migration, fix the nginx config on the actual box — it needs SSH. And here’s the uncomfortable part: Cursor’s agent runs terminal commands on your machine, so if your keys sit unlocked in ~/.ssh or a running ssh-agent, it doesn’t need you to “give” it anything — ssh prod already works. You’ve granted full server access by default, without deciding to.

There’s a better arrangement: the agent asks, and something you control does the authenticating. We’ve written about why the pasted-key route is the one move you can’t undo and what an MCP server actually is; this post is the practical version for Cursor. Twenty minutes, one VPS, no key ever enters the agent’s reach.

What you need

• Termalin — the desktop app, free tier is fine. It’s an SSH client with a built-in MCP server; that server is what Cursor will talk to.
• Cursor on the same machine.
• One host saved in Termalin — pick something low-stakes for the first run. Staging, a toy VPS, the box that only runs your RSS reader.

Step 1 — turn agent access on

Agent access is off by default. In Termalin, open Settings → MCP and enable it, then tick the hosts the agent may reach. Nothing outside that list exists as far as Cursor is concerned — a new host is a decision you make in the app, not something the agent can talk its way into.

Two things happen under the hood. Termalin writes a host inventory for the MCP server with agent-only auth entries — no passwords or keys land in that file. And authentication stays with the app’s key custodian: you unlock your keys once, Termalin signs on the agent’s behalf. There is no key file for the agent to read, so there’s nothing for it to leak — which also closes the ~/.ssh back door above, because the hosts worth protecting no longer need a loose key on your disk at all.

While you’re in settings, set each host’s agent policy: full access, an allowlist of commands, or blocked. Allowlist is the right starting point for anything you care about.

Step 2 — register the server in mcp.json

Cursor picks up MCP servers from a JSON file — .cursor/mcp.json in a project’s root for that project only, or ~/.cursor/mcp.json to make the server available everywhere. For a local (stdio) server like Termalin’s, the entry is a command and its arguments:

{
  "mcpServers": {
    "termalin": {
      "command": "<path>/termalin-mcp",
      "args": []
    }
  }
}

That’s the whole integration. The global file is the sensible choice here — server access isn’t a per-repo concern. Restart Cursor (or reload the MCP list in its settings), confirm the server shows as running, and the tools appear to the agent: hosts_list, ssh_exec, persistent sessions (session_open, session_exec), SFTP reads and writes.

One Cursor-specific note worth keeping: by default Cursor asks before executing a tool call. Leave that on for the first sessions. Auto-approval is a convenience you should extend one tool at a time, after you’ve watched how the agent uses each — the same way you’d widen the host list.

Step 3 — give it a real chore

Don’t start with a demo command; start with a task you’d actually do:

The health check on staging-1 has been flapping since yesterday’s deploy. Find out why and fix it.

Watch the agent work: it calls hosts_list, sees staging-1, opens a session, and starts pulling threads — service status, the last hundred log lines, the config diff against what’s running. It proposes a fix, applies it, and verifies the health check goes green.

The part that makes this comfortable is that none of it is invisible. Every session the agent opens appears in Termalin as a live terminal tab, and the watch grid shows all open sessions side by side with the agent-driven tiles highlighted. You’re not reading a summary after the fact — you’re watching the commands land as they run, and you can step in at any moment.

Where the boundaries are

Defaults worth knowing before you point it at anything you care about:

• Your keys never touch the agent’s environment. The custodian signs; the agent requests. Revoking access is a toggle in Settings, not a key rotation across your fleet.
• The agent’s reach is the allowlist you set in Step 1, and each host’s command policy bounds what it can run there.
• Typing into your session is separate. By default the agent opens its own sessions; acting inside one you already have open is its own consent toggle — it never rides along silently.
• Recordings mark agent activity. Session recordings capture output only — never your keystrokes — and every agent command is tagged as the agent’s in the audit log, with the device and IP it came from. At 2 a.m. you can tell “it did this” from “I did this”.

No desktop around? Use the hosted endpoint

If the agent runs where your desktop isn’t — CI, a cloud sandbox — create an API key in the Termalin web cabinet and point the client at the hosted MCP endpoint. Cursor’s mcp.json also takes remote servers by URL:

{
  "mcpServers": {
    "termalin": {
      "url": "https://termal.in/api/v1/mcp",
      "headers": { "Authorization": "Bearer tk_live_…" }
    }
  }
}

(If your Cursor build doesn’t support auth headers on remote servers yet, stay with the local stdio server — it’s the better default anyway.) The hosted endpoint only reaches servers you’ve enrolled with the tunnel agent, and each run authenticates with a short-lived certificate — same custodian idea, no standing credential anywhere. The keys are scoped to specific servers, expire on a schedule you pick, and die instantly when revoked. Details in the MCP docs.

The habit that makes it stick

Treat the first week like onboarding a new teammate who types very fast. Keep the watch grid open. Give it chores with a clear done-state — “make the health check pass”, “get the cert renewed” — and read how it gets there. Keep Cursor’s per-call approval on until the agent has earned auto-approve for the boring tools, and widen the host allowlist one unexciting box at a time.

The asymmetry is the point: the agent gets real reach, and you keep the one thing that can’t be taken back. (Running Claude Code instead? Same setup, one command.)

---

Termalin’s Free tier is the full desktop app, and every new account starts with a 14-day Pro trial — download it, or read the MCP docs first.