Cursor Agent SDK vs Docker Agent

Cursor Agent SDK

An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.

Docker Agent

An agent with an MCP server is eight lines of YAML, and the same file runs in a terminal, headless, or as an HTTP, MCP or A2A server. Usage telemetry is on by default and can carry prompts passed as command arguments, and two high-severity approval bypasses were fixed in August and September 2026.

Cursor Agent SDK

1. Install @grok/agent-sdk, not @cursor/agent-sdk from the launch post. That name answers 404 on npm
2. Set local.sandbox before a turn reads webhook payloads, pull request diffs or chat. Without it shell commands auto-approve with the host's credentials
3. Give every tool an effect. A tool without one counts as a write, runs once and is stubbed in dry runs
4. Start agent-sdk serve with --bearer-token on any shared host. --allow-anonymous admits every caller as one principal
5. Delete bot/hooks/memory.ts when sessions serve different people. The journal shares each turn's message and result with later turns

Docker Agent

1. Set TELEMETRY_ENABLED=false before run or exec with a prompt on the command line. Telemetry is on by default and sends positional arguments
2. For unattended runs pass --safety restricted with an allow-list, or --sandbox. Without a policy, --exec rejects every tool call that needs approval
3. Set max_iterations and a budget block in the config. Both are unlimited by default
4. Run 1.130.0 or later. Earlier versions ran shell commands embedded in local skills, and A2A sessions before 1.126.0 skipped tool approval
5. Review runtime.safety in any config pulled from a registry or URL. An author default of autonomous runs every tool call unprompted