{
 "schemaVersion": "1.0.0",
 "generatedAt": "2026-08-13T21:20:39Z",
 "claimContract": "A result describes only what this exact build did in this exact test. It does not establish purpose, retention, training use, sale, safety, or behavior in another account, region, operating system, or scenario.",
 "method": {
  "platform": "macOS 15 arm64",
  "network": "Existing operator VPN remained enabled. The lab does not claim a geographic cohort.",
  "capture": "Fresh per-run config and data directories; one CLI process per local mitmproxy instance; HTTP(S) proxy; dedicated test CA where accepted.",
  "redaction": "No credentials, header values, query strings, request bodies, response bodies, prompts, model output, file paths, or IP addresses are published.",
  "repeats": 3,
  "statusVocabulary": [
   "observed",
   "not_observed",
   "opaque",
   "inconclusive",
   "not_tested"
  ]
 },
 "tool": {
  "id": "cursor-cli",
  "name": "Cursor CLI",
  "vendor": "Cursor",
  "version": "2026.03.30-a5d3e17",
  "binarySha256": "77d530da58cd825ed91c6a66a95730af35cb6e8e6e494649bcdc92db2d42e070",
  "testedAt": "2026-08-13T21:19:45Z",
  "path": "/cursor/telemetry",
  "feed": "/cursor/telemetry/feed.xml",
  "status": "limited",
  "headline": "Invalid-key startup reached one Cursor host through two routes in 3/3 runs.",
  "summary": "Every clean-profile run called GetMe and the API-key exchange endpoint. A successful-session or privacy-mode comparison is not published yet.",
  "scenario": "Fresh Cursor config and data directories, ask mode, sandbox enabled, fixed prompt, deliberately invalid API key. Authentication stopped the run before model work.",
  "configs": [
   {
    "id": "default",
    "label": "Documented defaults",
    "repeats": 3,
    "requestCounts": [
     2,
     2,
     2
    ],
    "destinations": [
     {
      "host": "api2.cursor.sh",
      "owner": "Cursor",
      "classification": "first_party",
      "observedIn": 3,
      "paths": [
       {
        "method": "POST",
        "path": "/aiserver.v1.DashboardService/GetMe",
        "counts": [
         1,
         1,
         1
        ],
        "status": "observed"
       },
       {
        "method": "POST",
        "path": "/auth/exchange_user_api_key",
        "counts": [
         1,
         1,
         1
        ],
        "status": "observed"
       }
      ]
     }
    ]
   }
  ],
  "evidence": {
   "harness": "scripts/mitm-sanitize.py",
   "rawCaptureSha256": [
    "9e409732d7f33f3a9944d91d8460f8e3db0169109923dacb7f9efbee48728da8",
    "1dbd8625201976923c2ba624ec60a84a91fd6d1565a3dd6a61c6fd9d330a5fd9",
    "46540d63a9e5bff9b4905371e0dfce04a58d606d545ebe150e533eb3ffcf1044"
   ],
   "sanitizedManifestSha256": [
    "4379f979190becbfbaa38fb7dc2c1c2d916a98a20e5b926bbddc3fd065b60216",
    "dc42a6abdfbbc0d3b9a956519d5c20573795e6d6234e3030d6894dd6f26952d9",
    "1653e86adb0d11fcc9d88df0f89e222ae81f96b50ab0c8e2c9feef26f4b9da26"
   ]
  },
  "limitations": [
   "The run stopped at invalid API-key validation; no model or tool traffic was measured.",
   "Privacy Mode is account-scoped and was not compared in this unauthenticated test.",
   "The test used macOS arm64 and one network path behind the operator's existing VPN."
  ],
  "manifest": "/evidence/cursor-cli-2026.03.30.json"
 }
}