Does tracing Cursor (beta) with Rius send my code or prompts?

By default, Rius does not receive your code or prompts from Cursor (beta). The plugin sends structure only: the span tree, models, timing, tool names and error types. Prompts, answers and tool input and output leave your machine only from a folder where you run /rius-enable-content-here, and the plugin replaces the secrets it recognizes on your machine before sending, on a best-effort basis. Everyone in the workspace you sign in to can read what is sent.

How it works

Installing the plugin sends nothing, and tracing stays off for every folder until you enable one. Each developer chooses per folder, and the agent cannot turn tracing on by itself. See Coding agents for how the plugin agents compare.

For Cursor (beta), there are two modes:

• Structure only (/rius-enable-here): the span tree, timing, status, model names, tool names, error types and subagents. No prompts, answers, tool inputs or tool outputs.
• With content (/rius-enable-content-here): the same, plus your prompts, the agent’s answers, and tool inputs and outputs. File contents and command output can be part of those.

Tokens and cost are not in either mode for Cursor (beta), because Cursor does not give plugins token counts.

With content on, the plugin replaces the secrets it recognizes, such as cloud and API keys, tokens and private keys, with a marker before anything is sent. It also caps each value at 32 KB. This is best effort: a secret in a format the plugin does not know is sent.

A disabled folder always wins. If you run /rius-disable-here in a folder, it stays off even when a parent folder is enabled.

Every span also carries user.id, set to the email you signed in with (plugin 0.6.2 or later). For Claude Code, structure only also includes the folder path and the git branch.

On your machine, each event is first written to a file under ~/.cursor/rius/spool/, readable only by you. With content off, no content is written there. The plugin contacts three hosts and nothing else: ingest.eu.console.rius-glassflow.com for traces, connect.console.rius-glassflow.com for sign-in and sign-out, and mcp.eu.console.rius-glassflow.com when you use the MCP tools.

Set it up

1. Install the plugin and sign in with /rius-login. The Cursor (beta) guide covers install, sign-in and requirements in full. In Cursor’s plugin settings, choose Import from Repo and enter glassflow/rius-coding-agents.
2. In each repo you want traced, choose the least you need. Structure only is the safe default:

/rius-enable-here

3. Send content only from folders where you accept that prompts and tool output leave your machine:

/rius-enable-content-here

4. Check what a folder does with /rius-status. It shows whether the folder is traced and why.
5. Stop a folder with /rius-disable-here, or pause tracing for one chat with /rius-off. /rius-logout revokes your key and deletes it from the machine.
6. To force structure only from every folder on a machine, set this environment variable. It can only turn things off:

export RIUS_CAPTURE_CONTENT=false

RIUS_CURSOR_ENABLED=false turns Cursor (beta) tracing off everywhere, and RIUS_CURSOR_MAX_ATTR_BYTES lowers the 32 KB cap on each captured value.

To delete the local event files, folder rules and logs, remove ~/.cursor/rius/.

What you get

• Control per folder. A public side project can send content while a private repo stays structure only or off.
• A clear picture of what a trace holds. In structure-only mode you see the tree of turns, answers and tool calls with timing and errors, but not what was said or run.
• A key that only sends traces. Signing in stores one key for your machine in ~/.cursor/rius/credentials.json, readable only by you, with the ingest scope. A workspace admin can see it under Settings → API keys and revoke it.
• Clarity on who can read it. Each trace belongs to the workspace you chose at sign-in, and everyone in that workspace can read what is sent. If your team shares a workspace, agree which repos send content. Track Claude Code usage and cost across a team describes the same shared-workspace rule for the plugin.
• Fast cleanup. /rius-logout revokes the key, and a chat’s local event file is deleted once the chat has been idle for 7 days and its trace is closed.

When something else fits

• If you want no data at all to leave a folder, run /rius-disable-here there, or leave it unenabled.
• OpenHands behaves differently. It needs no plugin, and it always sends prompts and output, so use it only for conversations whose content you are happy to share with the workspace.
• Cursor’s cloud and background agents and Tab completions are not traced.

Related