Putting access controls around Cursor: session recording for AI coding agents

The most common way session recording for an AI coding agent goes wrong is subtle: the recording lives in the same process as the agent. The agent in Cursor logs its own actions, the team treats that log as the record, and the day something goes wrong the log is incomplete, edited by a retry, or simply missing the one command that mattered.

Lead with that failure, because it dictates the architecture. A recording the agent can influence is not a recording you can rely on. Everything else in this post follows from moving the record off the agent's path and onto the connection.

The pitfalls of in-agent session recording

Self-reported logs miss what the agent never chose to log. A crashed or retried run can leave gaps right where you most need detail. A log written to a path the agent controls can be truncated or overwritten. And a log that captures intent ("I will read the orders table") instead of the actual wire-level command tells you what the agent meant, not what it did. None of these survive an incident review, and an incident review is the only time anyone reads the recording closely.

The pattern underneath all four is the same: the record depends on the cooperation of the process you are trying to audit. The fix is to remove that dependency by moving the recording to the point the connection passes through, where the agent has no say.

How session recording works through hoop.dev

hoop.dev is an open-source Layer 7 access gateway. The Cursor agent reaches a database or service through it, and the gateway records the session as it happens:

• Recording is at the command level: the actual queries and commands that crossed the connection, not a summary.
• It runs at the gateway, outside the agent process, so the agent cannot edit or skip it.
• Each session is tied to the identity that authenticated, so the record answers who, not just what.

hoop.dev records the infrastructure actions the agent takes. It does not record the model's prompt or output, because that is not where the auditable action is. The action is the command that hit the database, and that is what crosses the gateway. You can read more about the gateway on the hoop.dev site.

Turning it on

1. Run the hoop.dev agent next to the resource and register the connection.
2. Confirm recording is enabled on that connection.
3. Route the Cursor agent through the connection rather than a direct credential.
4. Run a query, then open the session record and read back the exact command.

One model trusts the agent to report itself. The other captures the command where it crosses the boundary. Session recording belongs to the second, because only the second still has the data when the agent has crashed, retried, or been pointed away from the truth.

Pitfalls to avoid

Do not accept a chat transcript as the recording; it is the agent narrating, not the system observing. Do not let any connection bypass the gateway, because an unrecorded path is a hole in exactly the audit you are building. And do not run several agents under one shared identity, or the recording cannot tell their sessions apart when you most need it to.

There is a second benefit that shows up later. A command-level recording captured at the gateway is replayable. When you investigate an incident, you are not reading a paraphrase of what the agent intended; you are reading the exact sequence of statements that hit the database, in order, with timestamps and the identity attached. That is the difference between reconstructing what probably happened and reading what did happen. The agent's narration cannot give you that, because the agent only knows what it chose to record.

FAQ

Does session recording capture the model's reasoning?

No. It captures the commands the agent runs over the connection. hoop.dev does not read the prompt, completion, or reasoning.

What if the agent crashes mid-session?

The record lives at the gateway, not in the agent. A crash on the agent side does not erase what already crossed the connection.

Can I tie a session to a specific identity?

Yes. Each session is attributed to the identity that authenticated to the gateway.

Is hoop.dev open source?

Yes, it is MIT licensed.

Record agent sessions where they cannot be tampered with. Clone the hoop.dev GitHub repository and enable recording on your first connection using the getting started guide.