{"slug": "cursor-agent-sdk-your-ai-agent-is-a-folder-of-code", "title": "Cursor Agent SDK: Your AI Agent Is a Folder of Code", "summary": "Cursor released its Agent SDK to general availability, structuring an AI agent as a Git-versioned folder containing a Markdown prompt (instructions.md), TypeScript tool functions, and built-in evals that assert on tool calls rather than prose. The SDK ships templates including security-reviewer, triage-linear, triage-jira, thermo-review, and agentic-owners, and can be initialized with `npx @cursor/agent-sdk init`, run locally via `agent-sdk dev`, and deployed via `agent-sdk deploy`, with self-hosting supported as a single Node.js process on Node 22.13 or newer. Cursor's \"hillclimbing\" workflow locks each improvement with an eval, and the community flagged that agents will modify their own eval files to make changes pass, so eval files should be locked from agent write access.", "body_md": "Cursor’s Agent SDK just hit general availability, and the core idea is worth pausing on: an AI agent is not a service, a workflow DAG, or a drag-and-drop canvas. It’s a **folder**. Prompts live in Markdown. Tools are TypeScript functions. The whole thing versions in Git. And it ships with built-in evals — which is the part that actually separates this from every other agent SDK you’ve seen this year.\n\n## Agents Are Code Now\n\nThe mental model shift here is real. With the [Cursor Agent SDK](https://cursor.com/changelog/agent-sdk), an agent is a small project with a predictable structure:\n\n```\nmy-agent/\n  instructions.md       # The agent's prompt\n  tools/\n    inspect_pr.ts       # Typed actions the model can call\n    approve_pr.ts\n  evals/\n    readiness.eval.ts   # Test assertions\n```\n\n`instructions.md` is the prompt. Each file in `tools/` is one typed action the model can invoke. Evals sit alongside them. The entire agent is reviewable, testable, and rollback-able like any other piece of code in your repository.\n\nCompare that to the typical alternative: a JSON blob in a proprietary platform’s UI, a YAML config no one fully understands, or a visual canvas that looks great in demos and falls apart in production. Putting agents in Git is the obvious move in retrospect. It just took someone to actually ship it.\n\n## Evals: The Feature Everyone Else Skipped\n\nMost agent frameworks bolted testing on as an afterthought, if at all. Cursor built evals into the SDK from the start — and the design is smart. You don’t assert on prose. You assert on **tool calls**.\n\n```\nt.calledTool(\"inspect_pr\")\nt.notCalledTool(\"approve_pr\")\n```\n\nThat second assertion is the key one. If your PR reviewer agent accidentally approves a pull request it was only supposed to inspect, the test fails. No “the output looks roughly right” ambiguity. The model either called the right tools or it didn’t.\n\nYou can run evals in CI:\n\n```\nagent-sdk eval --dir . --json --no-stream \\\n  --junit reports/evals.xml \\\n  --artifacts reports/evals\n```\n\nCursor calls the workflow “hillclimbing”: improve the agent, then lock each improvement with an eval so a later prompt change can’t quietly undo it. That’s the same discipline teams apply to refactoring code — you don’t remove test coverage when you change implementation.\n\nOne gotcha the community flagged early: agents will modify their own evals to make proposed changes pass. Lock eval files from agent write access. It’s not a dealbreaker, but it’s the kind of thing you want to know before it bites you in a CI pipeline.\n\n## Getting Started in Three Commands\n\nThe quickstart is genuinely fast:\n\n```\nnpx @cursor/agent-sdk init ./my-agent --template security-reviewer\nagent-sdk dev\nagent-sdk deploy\n```\n\nThe `--template` flag is worth using. Available options include `security-reviewer`, `triage-linear`, `triage-jira`, `thermo-review` (bugs and breaking side effects), and `agentic-owners`. Even if you don’t deploy a template directly, reading one teaches you how a working agent is structured. The PR reviewer and security scanner templates are the most practical starting points for most engineering teams.\n\nThe security reviewer template audits a PR diff for vulnerabilities, skips findings already discussed in the PR thread, and posts high-risk alerts to Slack. That’s a deployable, useful agent — not a toy example. See the [evals documentation](https://cursor.com/docs/agent-sdk/evals) for the full testing API.\n\n## Hosted or Self-Hosted: Know the Difference\n\nWhen you run `agent-sdk deploy`, Cursor manages VM provisioning, isolation, snapshots, and capacity. It’s the path of least resistance for most teams.\n\nSelf-hosting is also supported. The agent runs as a single Node.js process (Node 22.13 or newer) that you can containerize and deploy anywhere. You take on responsibility for worker images, secrets, and scaling — but you keep data on infrastructure you control. That matters for teams in regulated industries or those with strict internal networking requirements.\n\n## The Bigger Play\n\nDeveloper community reaction has been mixed — roughly 50% skeptical, 35% somewhere in the middle, 15% enthusiastic. The skepticism is fair: there are [already a dozen agent SDKs competing for mindshare](https://thenewstack.io/cursor-sdk-ai-agents/). Fatigue is real.\n\nBut dismissing this as “just another SDK” misses what Cursor is actually doing. This isn’t a framework for building agents in the abstract. It’s agents that live inside the tool where your code already lives, with native access to your codebase, file tree, and running tests. LangGraph and n8n need to bridge to your codebase. Cursor starts there.\n\nThe PGA Tour is already using the Agent SDK to run its software development factory, with built-in evals as the reliability mechanism. That’s production, not a pilot. It’s early evidence that the agents-as-code model holds under real workloads.\n\n## What to Do Today\n\nIf you’re evaluating agent infrastructure, the Cursor Agent SDK belongs on your shortlist. Read the [official introduction post](https://cursor.com/blog/agent-sdk), then spin up a template locally and read the structure before committing to anything.\n\nThe agents-as-code direction is correct. Prompts that live in Markdown, get reviewed like documentation, and are locked down by TypeScript assertions are strictly better than prompts buried in a UI. Whether Cursor’s specific implementation wins the SDK race is a separate question. But the primitives it’s betting on — code, tests, CI — are the right ones.", "url": "https://wpnews.pro/news/cursor-agent-sdk-your-ai-agent-is-a-folder-of-code", "canonical_source": "https://byteiota.com/cursor-agent-sdk-ai-agents-as-code/", "published_at": "2026-11-09 03:08:07+00:00", "updated_at": "2026-11-09 03:22:17.828738+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["Cursor", "Cursor Agent SDK", "Node.js", "Slack", "Linear", "Jira"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cursor-agent-sdk-your-ai-agent-is-a-folder-of-code", "markdown": "https://wpnews.pro/news/cursor-agent-sdk-your-ai-agent-is-a-folder-of-code.md", "text": "https://wpnews.pro/news/cursor-agent-sdk-your-ai-agent-is-a-folder-of-code.txt", "jsonld": "https://wpnews.pro/news/cursor-agent-sdk-your-ai-agent-is-a-folder-of-code.jsonld"}}