{
 "schemaVersion": "1.0.0",
 "generatedAt": "2026-08-14T05:20:51.429Z",
 "claimContract": "A result describes only what this exact build did in this exact test. It does not establish purpose, retention, training use, sale, safety, or behavior in another account, region, operating system, or scenario.",
 "method": {
  "platform": "macOS 26.2 arm64 (Darwin 25.2.0)",
  "network": "Existing operator VPN remained enabled. The lab does not claim a geographic cohort.",
  "capture": "Fresh HOME/tool config/workspace per run; one pinned mitmproxy 12.2.3 process and CA per run; minimal environment with fixed invalid canary key.",
  "redaction": "No credentials, header values, query strings, request bodies, response bodies, prompts, model output, file paths, or IP addresses are published.",
  "repeats": 3,
  "statusVocabulary": [
   "observed",
   "not_observed",
   "opaque",
   "inconclusive",
   "not_tested"
  ],
  "captureWindowMs": 45000,
  "acquisition": "Exact official npm package plus platform-native optional binary; package lock and binary are hashed.",
  "requestDefinition": "HTTP request recorded when observed at the proxy; a null response status means the request began but no response completed before the process/window ended."
 },
 "tool": {
  "id": "cursor-cli",
  "name": "Cursor CLI",
  "vendor": "Cursor",
  "version": "2026.03.30-a5d3e17",
  "binarySha256": "77d530da58cd825ed91c6a66a95730af35cb6e8e6e494649bcdc92db2d42e070",
  "testedAt": "2026-08-13T21:19:45Z",
  "path": "/cursor/telemetry",
  "feed": "/cursor/telemetry/feed.xml",
  "status": "limited",
  "headline": "Invalid-key startup reached one Cursor host through two routes in 3/3 runs.",
  "summary": "Every clean-profile run called GetMe and the API-key exchange endpoint. A successful-session or privacy-mode comparison is not published yet.",
  "scenario": "Fresh Cursor config and data directories, ask mode, sandbox enabled, fixed prompt, deliberately invalid API key. Authentication stopped the run before model work.",
  "configs": [
   {
    "id": "default",
    "label": "Documented defaults",
    "repeats": 3,
    "requestCounts": [
     2,
     2,
     2
    ],
    "destinations": [
     {
      "host": "api2.cursor.sh",
      "owner": "Cursor",
      "classification": "first_party",
      "observedIn": 3,
      "paths": [
       {
        "method": "POST",
        "path": "/aiserver.v1.DashboardService/GetMe",
        "counts": [
         1,
         1,
         1
        ],
        "status": "observed"
       },
       {
        "method": "POST",
        "path": "/auth/exchange_user_api_key",
        "counts": [
         1,
         1,
         1
        ],
        "status": "observed"
       }
      ]
     }
    ]
   }
  ],
  "evidence": {
   "harness": "scripts/mitm-sanitize.py",
   "rawCaptureSha256": [
    "9e409732d7f33f3a9944d91d8460f8e3db0169109923dacb7f9efbee48728da8",
    "1dbd8625201976923c2ba624ec60a84a91fd6d1565a3dd6a61c6fd9d330a5fd9",
    "46540d63a9e5bff9b4905371e0dfce04a58d606d545ebe150e533eb3ffcf1044"
   ],
   "sanitizedManifestSha256": [
    "4379f979190becbfbaa38fb7dc2c1c2d916a98a20e5b926bbddc3fd065b60216",
    "dc42a6abdfbbc0d3b9a956519d5c20573795e6d6234e3030d6894dd6f26952d9",
    "1653e86adb0d11fcc9d88df0f89e222ae81f96b50ab0c8e2c9feef26f4b9da26"
   ]
  },
  "limitations": [
   "The run stopped at invalid API-key validation; no model or tool traffic was measured.",
   "Privacy Mode is account-scoped and was not compared in this unauthenticated test.",
   "The test used macOS arm64 and one network path behind the operator's existing VPN."
  ],
  "manifest": "/evidence/cursor-cli-2026.03.30-a5d3e17.json",
  "protocolVersion": "1.0.0-legacy-response-only"
 }
}