# Cursor Agent SDK vs LlamaIndex Framework (slim)

> LlamaIndex Framework scores 70 (BB) to Cursor Agent SDK's 63.7 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-llamaindex.md (~4,750 tokens) · this version ~2,630 tokens · JSON https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-llamaindex.json · canonical https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-llamaindex
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

LlamaIndex Framework scores 70 (BB) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 4 of 7 scored categories. Cursor Agent SDK leads on agent ergonomics and maintenance & community. Both do agent frameworks.

- Cursor Agent SDK: B 63.7, rank #503 of 1510 · https://www.anchorterminal.com/tools/cursor-agent-sdk.min.md
- LlamaIndex Framework: BB 70, rank #217 of 1510 · https://www.anchorterminal.com/tools/llamaindex.min.md
- Cursor Agent SDK, good for Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting. Ahead on Agent ergonomics, 80 against 73; Maintenance & community, 74 against 69.
- LlamaIndex Framework, good for Python teams building retrieval-heavy agents over their own data, with many connectors. Ahead on Reliability, 70 against 45; Security & auth, 74 against 68; Payments & pricing, 60 against 30. Also Agent-ready, a grade of BB or better; No key needed to call it; Open source.

| Category | Cursor Agent SDK | LlamaIndex Framework |
| --- | --- | --- |
| Reliability (16%) | 45 | 70 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 82 | 85 |
| Agent ergonomics (13%) | 80 | 73 |
| Security & auth (14%) | 68 | 74 |
| Payments & pricing (10%) | 30 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 74 | 69 |
| Transparency & trust (7%) | 71 | 67 |

| Fact (where they differ) | Cursor Agent SDK | LlamaIndex Framework |
| --- | --- | --- |
| Vendor | Cursor | LlamaIndex |
| Auth | OAuth or key | None |
| Pricing | Your plan | Free |
| Licence | Proprietary. The package's LICENSE.md reads "© Anysphere Inc. All rights reserved", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published | MIT |
| Last release | 2026-10-25 | 2026-09-21 |
| Terms last updated | 2026-09-03 | no document linked |
| Privacy policy last updated | 2026-09-29 | 2026-08-24 |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | none | 53k stars, 1.3M PyPI/wk |

Why the edge:
- Payments & pricing, LlamaIndex Framework +30: Cursor Agent SDK 30 (Framework reading of the published rubric. No payment protocol (0). Per-million-token prices for Cursor models, including the default Grok 4.5 with Fast, and plan prices are public, but no price for managed hosting and no statement of which plans cover the Agent SDK were found (15). The package is free and the Free plan needs no card, but its usage is only described as limited agent requests (15). A person signs in through a browser or creates an API key in the dashboard before a model turn runs (0). 0+15+15+0 = 30.); LlamaIndex Framework 60 (Self-hosted rule. Free MIT packages with nothing to buy for the framework itself (20 + 20 + 20). No payment protocol (0). LlamaCloud is graded on its own listing. 0+20+20+20 = 60.)
- Reliability, LlamaIndex Framework +25: Cursor Agent SDK 45 (Local-package reading, since the owner runs the framework, with Cursor's hosting as an option. Official npm package with Node 22.13 or newer stated in engines and in the docs, which also say never Bun (20). Closed source, so no public CI or test suite (0). No public issue tracker. github.com/cursor/cursor holds a README and SECURITY.md, and forum.cursor.com has no Agent SDK tag, so there's nothing to count open crashes against. The troubleshooting page lists known failures with fixes (5). A dated changelog of two entries, 0.2.29 and 0.3.0, both 23 October 2026, and 0.3.0 calls out the removed `persistent` option, but the 27 earlier @cursor/bdk versions and 123 @cursor/july versions have no notes, and one build ships under three package names (5). Version 0.3.0, but the changelog post of 20 October says generally available and the docs changelog labels 0.3.0 the GA release, which we read as declared stable (15). 20+0+5+5+15 = 45.); LlamaIndex Framework 70 (Local-package reading. Official PyPI packages with Python 3.10 to below 4.0 (20). Public unit-test, type-check, lint, coverage and CodeQL workflows, with the type-check, lint and CodeQL runs on main passing on 3 November (25). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). A dated, generated changelog per package, but core is 0.x and minors such as 0.13 and 0.14 carried breaking changes (8). Core isn't 1.0; Workflows is at 2.x, so partial (5). 20+25+12+8+5 = 70.)
- Agent ergonomics, Cursor Agent SDK +7: Cursor Agent SDK 80 (Framework reading, scored on what it takes to run a tool-calling agent with MCP. One file per tool and one file per MCP connection, `tools` and `disallowedTools` filters with `effects: "read"`, and an allowlist for the harness's built-in tools (22). Concurrency caps with queued turns, `--fields`, page tokens and limits on list commands, and a per-session cost view. We found no turn cap or spend cap for a run (12). Built-in routes return `{ ok: false, error }` codes, direct tool calls have documented 400, 404, 409 and 500 codes, and the CLI has seven exit codes (18). Reads and idempotent calls retry up to three times, writes run once, MCP readOnlyHint and idempotentHint decide retries for connection tools, and dry-run sessions stub writes (20). `agent-sdk init` scaffolds a working project and every agent field is optional, but the framework is TypeScript only (8). 22+12+18+20+8 = 80.); LlamaIndex Framework 73 (Framework reading. MCP tools through a separate llama-index-tools-mcp package, with allowed tools selectable (18). Memory token limits, iteration caps and streaming events (16). Tool errors returned to the agent, with few typed errors (12). Workflow context serialises and resumes, and the DBOS package makes runs durable (16). Few required parameters, but OpenAI is the silent default for LLM and embeddings, Python here with a separate TypeScript edition (11). 18+16+12+16+11 = 73.)
- Security & auth, LlamaIndex Framework +6: Cursor Agent SDK 68 (Framework reading. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. Every model turn goes through Cursor's backend with a Cursor credential, even on a self-hosted server, and the data-use page says Cursor may store and train on prompts and code with Privacy Mode off. Managed hosting stores the repository and agent data whatever the Privacy Mode setting. OpenTelemetry export is off until an endpoint is set, with prompt text and tool payloads behind separate flags, and the npm update check has a documented switch. Install copies skills into ~/.cursor/skills (18). `needsApproval` parks a tool call for a person, dry runs stub writes and the harness tools take an allowlist, but `local.sandbox` is off by default, so shell commands auto-approve with the host's environment and file tools reach any path the process can. Hosted deployments enforce an egress allowlist (12). The docs tell you to turn the sandbox on for webhook payloads, diffs and chat, document HMAC and shared-secret auth on webhook routes, and warn that anyone who can talk to the agent can drive Cursor account connectors. The scaffolded memory journal shares turns across sessions, with an instruction to treat it as untrusted (10). Sessions keep every message and tool call, hooks can mirror them for audit, and `ctx.approvedBy` records the approver (14). security.txt and SECURITY.md with a disclosure address and Cursor's GitHub advisories, no bug bounty found, and no advisory for the three package names in OSV on 2 November (14). SOC 2 and ISO 27001 aren't scored on the framework reading. 18+12+10+14+14 = 68.); LlamaIndex Framework 74 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No telemetry found in llama-index-core (25). Human-in-the-loop events in Workflows and agents can wait for a person, but there's no per-tool approval primitive and CodeActAgent's executor is the developer's to supply (12). The threat model puts input validation on the application, with no prompt-injection guidance in the agent pages (5). Instrumentation events and callback handlers for tracing (14). A huntr bug bounty, GitHub private reporting and public advisories with fixed versions (18). 25+12+5+14+18 = 74.)
- Maintenance & community, Cursor Agent SDK +5: Cursor Agent SDK 74 (0.3.0 on npm on 25 October 2026, per the 27 October check (npm not re-read on 2 November), and the docs changelog still ends at 0.3.0 of 23 October (30). Five @grok/agent-sdk versions from 22 to 25 October and 29 @cursor/bdk versions since 22 September, per the 27 October check (20). Closed product. A public changelog with two entries and a forum with no Agent SDK tag, so we couldn't see replies to SDK reports (8). The npm package is current and official, TypeScript only (12). Dependencies are current releases, but there's no public CI and the same build goes out under three names with a postinstall script (4). 30+20+8+12+4 = 74.); LlamaIndex Framework 69 (llama-index-core 0.14.25 on 21 September 2026, 46 days before this check (20). Two core changelog entries in the 90 days (19 August and 21 September), with integration packages and Workflows (2.24.1 to 2.26.1) publishing in between, so partial (12). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). Core, Workflows and integrations are current (15). CI and CodeQL passing on main and a stale-package policy that moves unmaintained integrations out of main (10). 20+12+12+15+10 = 69.)