Grok Bot

# Fix list: Grok Bot

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/grok-bot, the October 2026 research run, assessed 12 October 2026. Grade E, 45.2 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Grok Bot: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 40 out of 100, up to 12 more on the total

Why it scored 40: Read with the hosted lines. status.cursor.com has a Grok Bot component with 90 days of uptime history (20). The history page lists sixteen incidents that name Grok Bot between 18 August and 9 October 2026, seven of them marked major. They fell on 3 September (routine triggers, one hour), 7 September (computers unreachable for some users, 65 minutes), 16 September (six and a half hours), 17 September (two hours), 18 September (two, about three hours and under six hours) and 6 October (with Cloud Agents, restored after about two hours). Several majors (0). Product limits are published for routines (50 a Bot, five minutes apart, 20 run records), unattended approvals (about 10 minutes) and group chats (two to six Bots), but the weekly usage allowance has no number (7 of 15). The plans page says what happens when usage runs out and that the monthly limit is not a hard stop mid-run, and the docs give recover, update and reset steps for the computer and advise idempotent retries in routines, with no retry guarantees (5 of 15). No SLA was found, and the Grok Bot Terms say the documentation creates no service level (0). No beta label on the pages read, though teach-by-demonstration, cross-conversation search, Enterprise access and X tagging are described as rolling out or limited by region (8 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Schema & documentation, 40 out of 100, up to 9.8 more on the total

Why it scored 40: Grok Bot is an app, so the API lines are read for what a person or an agent setting it up can rely on. No machine-readable contract for the assistant was found. The docs link an Admin API for team settings on cursor.com, which we did not read (0 of 25). docs.x.ai serves an llms.txt that lists every Grok Bot page, a Markdown copy of each page and a Copy for LLM button (10). The pages state purpose and limits plainly, including what Auto Review does not cover, what deleting a Bot leaves behind and that separate Bots are not a security boundary (16 of 20). The interface is natural language. Auto-review rules are free text, and the one typed format found is the secret name pattern for Team Bots (3 of 15). Example prompts on most pages and a table of @bot replies with their meaning. A troubleshooting page exists and was not read (9 of 15). No Grok Bot changelog or version history was found. The desktop app shows its version, and the Grok Bot Terms carry a last-updated date (2 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 3. Payments & pricing, 25 out of 100, up to 9.4 more on the total

Why it scored 25: No machine payment protocol (0). Pricing is by plan and public. Cursor's pricing page shows Individual at $20 a month and Teams at $40 a user a month with Grok Bot included, but the weekly usage amounts and the on-demand rate are not published on the pages read (10 of 20). The plans page describes a free trial as a usage credit with a 7-day window that never becomes a paid plan, and Cursor's free Hobby plan needs no card. Whether the Grok Bot trial itself needs a card is not stated (15 of 20). A person signs in through a browser, so an agent cannot start alone (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 4. Agent ergonomics, 50 out of 100, up to 8.1 more on the total

Why it scored 50: Read for an owner directing the assistant. Usage is metered by agent steps and tokens with a weekly allowance and an on-demand monthly limit, but there is no budget for one task, no separate Grok Bot spend cap and no model choice (10 of 25). A search palette covers Bots, messages, files and routines, each routine keeps its 20 latest runs, and notifications are set for each Bot (10 of 20). Errors show above the composer with a request ID, expired approvals are labelled, blocked plugins read Disabled by team admin, and the @bot replies are documented (12 of 20). Allow once, Always allow and Deny on each request, Ask first rules, drafts with Send and Discard, and a Test run that the docs warn performs real work. A Stop now message does not undo completed actions and nothing is described as reversible (10 of 20). Defaults lean cautious for local commands (Ask every time) and a Bot starts with no access, while network access defaults to allow-all. Apps for five platforms and no SDK (8 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 5. Maintenance & community, 20 out of 100, up to 7 more on the total

Why it scored 20: No dated release notes or changelog for Grok Bot were found. Cursor's changelog entries from 29 July to 6 October 2026 do not mention it, and x.ai/bot, which may carry versions, answered 403. Scored as absent, which may understate a service that had status updates through 9 October 2026 (0 of 30, and 0 of 20 for three dated entries). Support runs through support@x.ai, a Discord server, Cursor's help centre with Grok Bot articles and a status page with dated incident updates (10 of 15 for a closed service). No SDK and not an MCP server. Official apps for five platforms update themselves (5 of 15). The cloud computer's image is updated with files kept, and no public build or test record exists (5 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 6. Security & auth, 68 out of 100, up to 5.6 more on the total

Why it scored 68: Read with the tool lines, applied to the accounts the assistant holds. Bots work as the signed-in member with no identity of their own. Connector OAuth tokens stay on Cursor's backend and are never stored on the computer, passwords and two-factor steps go to the owner by takeover, and a secure secret request keeps a value away from the model. Against that, browser sessions, cookies and command-line credentials persist on one cloud computer that every Bot of the user shares, and connector scopes are not listed on the pages read (20 of 30). Approvals, Ask first and Allow automatically rules, editable drafts, a 10-minute expiry on unattended approvals and Ask every time for local commands. The FAQ says which actions need approval depends on the tool, the risk and the owner's rules, Auto Review is model-based and does not check memory writes or most settings changes, Team Bot plugins run without asking, and the terms call these controls aids only (13 of 20). A prompt-injection section says outside content is marked as untrusted, Auto Review checks actions against the request, and network policy and approvals sit beneath it, and that the risk is reduced, not removed (11 of 15). The transcript shows tool activity and computer use and routines keep run records. Audit logs, Action Recording and OpenTelemetry export are Enterprise only (8 of 15). security.txt and a disclosure address with a five-business-day acknowledgement, ISO/IEC 27001 and 42001 with Grok Bot in scope per the docs, SOC 2 Type II and AIUC-1 per Cursor's security page, yearly penetration tests, and advisories published on GitHub, none of the ten newest naming Grok Bot. No bug bounty found (16 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 7. Transparency & trust, 66 out of 100, up to 3 more on the total

Made of editorial 48, provenance 84.

Why it scored 66: Closed source with clear terms. The Grok Bot Terms and Cursor's Terms of Service are public and dated (15 of 30). The docs give concrete periods (Action Recording kept 90 days, account data removed within 30 days, deletion within 30 days of written direction under the DPA, daily backups) and say plainly that deleting a Bot leaves files and sessions. They give no period for a deleted Bot's backend data beyond the applicable Cursor terms, the privacy policy says only as long as necessary, and there is no retention policy per organisation. Training is off with Privacy Mode, and the privacy policy says inputs are not used for training unless flagged, reported or agreed (19 of 30). No deprecation policy. The terms say the documentation is no commitment that any function, integration or model will stay, with reasonable notice only for materially adverse changes to the terms (4 of 20). Computers run in the United States with no residency commitment, the subprocessor list is on a trust portal we could not read, and the docs say no fixed set of model vendors is guaranteed (10 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Terms of service: read, states 4 of the 7 things a reader expects (7.4 of 10)
- Privacy policy: read, states 7 of the 8 things a reader expects (9.3 of 10)
- Changelog: not found (0 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- Kind. We chose `platform`, the brief's kind for a desktop, web or phone app, because Grok Bot is reached through its own apps, Slack and X and has no API an outside agent calls. `metrics.kind` is `remote` and it is graded as a hosted service
- Vendor. The lead named xAI. The docs are on docs.x.ai and name SpaceXAI, while accounts, billing, hosting, terms, privacy policy and status page are Cursor's (Anysphere, Inc.). No page read states how the companies are related
- The lead said access comes through eligible Cursor and SuperGrok plans. The plans page confirms that and adds X Premium+ and self-serve Grok Business seats
- Unchecked: a Business Insider report of 10 October 2026 named in the lead. We did not read it, nothing on the vendor pages read mentions an incident of that kind, and no deduction is taken
- Unchecked: x.ai/bot (downloads and product page), the x.ai legal index and the third-party bot terms at x.ai/legal/bot-sharing-terms. x.ai/bot answered HTTP 403 and we sent x.ai nothing more
- Unchecked: status.x.ai, which the docs header links, answered HTTP 403. Reliability is scored on status.cursor.com, which has the Grok Bot component
- Unchecked: release dates. No Grok Bot changelog or version history was found, so `lastRelease` is null and Maintenance scores recency as absent
- Unchecked: the list of connectors in Connect apps and their scopes. Cursor's changelog of 3 August 2026 announces Gmail, Google Drive and Calendar plugins for Cursor, and the Grok Bot docs mention email and Slack drafts, an X plugin, Jira and Linear, without a full list
- Unchecked: the subprocessor list and certificates on trust.cursor.com (a script-drawn portal whose robots.txt request returned the portal page), the DPA, and Cursor's privacy overview on training data
- Unchecked: the Pro+ and Ultra prices (behind tabs on the pricing page), the weekly usage amounts and the on-demand rate
- Unchecked: these docs pages, left unread to keep to the page limit. Mobile, files and results, use cases, troubleshooting, identity and access, private networks, proxies, manage computers, and the Admin API on cursor.com
- Unchecked: whether Auto Review is on by default for an individual account. The docs describe behaviour with Auto Review on and say Enterprise admins can enforce it
- Whether single memories can be viewed, exported or deleted. The docs read describe what a Bot remembers and say to correct stale assumptions in conversation
- Cursor's Terms of Service bar scraping, probing and scanning the Service and restrict sharing benchmark results. This matters before any probe or task suite is run
- We read 16 pages on docs.x.ai, one over the brief's limit of about fifteen

## Weaknesses

- All of one user's Bots share one cloud computer, with its files, browser sessions and command-line credentials. The docs say separate Bots are not a security boundary
- The review model does not check memory writes or most settings changes, and the Grok Bot Terms call approval controls aids only
- Deleting a Bot leaves shared files and browser sessions on the computer. No way to view or delete single memories was found in the docs read
- Seven incidents marked major named Grok Bot on status.cursor.com between 3 September and 6 October 2026, the longest about six and a half hours
- Audit logs, Action Recording, network allowlists and enforced review rules are Enterprise only. Other teams default to allow-all network access
- Cursor chooses the model with no picker and no fixed set of model vendors, and no Grok Bot changelog was found

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- State in each request what the Bot may change and where it must stop. Which actions pause for approval depends on the tool, the risk and the owner's Auto-review rules
- Add narrow Ask first rules for sending, publishing, purchasing and deleting. Ask first wins over Allow automatically when both match
- Treat any sign-in or file on the cloud computer as available to every Bot on the account. Give a workload its own Cursor user when it needs separate credentials
- Run Test run with safe inputs. A test run performs real work and can call connected tools
- To remove access, pause routines, sign out of sites on the computer, uninstall connectors and revoke them at the source service. Deleting the Bot is not enough

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.