Cursor SDK grows up: custom tools without an MCP server, auto-review for headless runs

Cursor shipped a substantial SDK release (June 4) that removes two real frictions in running agents from scripts and CI.

Custom tools without standing up an MCP server. Pass function definitions through local.customTools and the SDK exposes them via a built-in MCP server, through the same permission gate as any other tool — and they're visible to every subagent in the run. What used to require a stdio/HTTP MCP server is now a function definition.

Auto-review for headless runs. By default a headless SDK agent executes tool calls unsupervised. local.autoReview routes calls through a classifier instead, steered by natural-language rules in permissions.json — e.g. allow read-only inspection of ./dist, always hold delete operations. That's a meaningful middle ground between "fully unattended" and "human approves everything," and it mirrors where the whole industry is converging on agent permissioning.

Also in the release: pluggable state stores (SQLite, an append-only JSONL store you can diff and commit, or your own LocalAgentStore backed by Postgres or memory), nested subagents to any depth with per-level prompts and models, and a platform-generated requestId on every run for correlating CI runs with logs. Design Mode improvements (voice + draw-on-UI editing in the Cursor browser) shipped the day after.

Sources: Cursor changelog: SDK updates, Cursor changelog: Design Mode