Cursor Agent SDK vs Agent Development Kit (ADK)

Cursor Agent SDK

An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.

Agent Development Kit (ADK)

Python, TypeScript, Go, Java and Kotlin, with tool confirmation and context compaction built in. Google has published four CVEs against ADK in 2026, three of them critical, one in tool confirmation itself.

Cursor Agent SDK

1. Install @grok/agent-sdk, not @cursor/agent-sdk from the launch post. That name answers 404 on npm
2. Set local.sandbox before a turn reads webhook payloads, pull request diffs or chat. Without it shell commands auto-approve with the host's credentials
3. Give every tool an effect. A tool without one counts as a write, runs once and is stubbed in dry runs
4. Start agent-sdk serve with --bearer-token on any shared host. --allow-anonymous admits every caller as one principal
5. Delete bot/hooks/memory.ts when sessions serve different people. The journal shares each turn's message and result with later turns

Agent Development Kit (ADK)

1. Run 2.7.0 or later, which fixes the adk web code-injection CVE and the tool-confirmation forgery
2. Always pass tool_filter to McpToolset
3. Pin a 2.x minor and read the changelog before each bump. 2.12.0 needs Python 3.11 or later, which its changelog doesn't say
4. Set EventsCompactionConfig on the App for long sessions so context doesn't grow without limit
5. Keep ADK Web off public interfaces