Configure OpenTelemetry Export for Grok Bot Action Recording

OpenTelemetry Export is the Enterprise path that streams sanitized Bot-action events (and other Cursor telemetry) to a collector you run. Configure it under Team Settings → OpenTelemetry Export. Official guides: OpenTelemetry Export, Wire Reference, and Grok Bot for teams and enterprises → Admin controls.

Self-serve Teams do not get this control. Action Recording events never appear on the Audit Log page — Audit Logs cover admin, security, and authentication (plus Grok Bot control-plane) events; Bot actions go through Action Recording and this export.

Prerequisites

1. Turn on Action Recording on the Grok Bot page of the Cursor dashboard (Enterprise; off by default; 90-day internal retention). Privacy Mode (Legacy) forces recording off.
2. Run an HTTPS endpoint that accepts OTLP/HTTP binary protobuf on /v1/metrics and /v1/logs. Datadog Agent OTLP ingest, OpenTelemetry Collector, and ClickHouse/ClickStack all work. gRPC and JSON are not supported.
3. Have a bearer token or API key Cursor can send as a request header.
4. Make the endpoint reachable from the public internet. Cursor egresses from fixed source IPs (all /32): 3.218.161.44, 3.231.18.206, 35.174.159.35, 184.73.225.134, 3.209.66.12, 52.44.113.131. Use TLS and auth as the primary control; add IP allowlisting if your network requires it.

Enable the destination

In Team Settings → OpenTelemetry Export:

1. Create destination with the HTTPS base URL (no /v1/... suffix — Cursor appends /v1/metrics and /v1/logs) and auth headers.
2. Test connection to check the URL and auth.
3. Enable. Export starts within about a minute.

Each signal and telemetry family has its own toggle. New families default on unless you turn off auto_enable_new_families.

For Grok Bot Action Recording logs, leave (or turn on) the family grok_bot_agent_actions. That family requires Action Recording enabled on the Grok Bot page. Events are sanitized before export: shell commands are secret-scrubbed; browser URLs lose query strings and fragments. Resource attribute cursor.surface=grok_bot tags Grok Bot traffic across families.

Minimal collector sketch

Enter https://otel.example.com in Cursor (not https://otel.example.com:4318/v1). Terminate TLS in front of the collector.

receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318
processors:
  batch:
exporters:
  logging:
    verbosity: basic
service:
  pipelines:
    metrics:
      receivers: [otlp]
      processors: [batch]
      exporters: [logging]
    logs:
      receivers: [otlp]
      processors: [batch]
      exporters: [logging]

For Datadog Agent OTLP ingest, enable HTTP on 0.0.0.0:4318 and logs (otlp_config.logs.enabled / DD_OTLP_CONFIG_LOGS_ENABLED=true), expose 4318 or terminate TLS on 443 and proxy. Point Cursor at the public HTTPS base in front of that listener.

Grok Bot events on the wire

Scope: cursor.telemetry 0.1.0. Family grok_bot_agent_actions includes:

Log event	Meaning
cursor.grok_bot.mcp_tool_call	Connector (MCP) tool call
cursor.grok_bot.shell_command	Shell command (secrets scrubbed)
cursor.grok_bot.browser_navigation	Browser navigation
cursor.grok_bot.computer_use_session	Computer-use session summary

Useful joins (see Wire Reference for full attributes):

• Dedupe logs on cursor.event.id (at-least-once delivery).
• Group one Bot with cursor.conversation.id.
• Group one turn’s Action Recording rows with cursor.grok_bot.turn.id when present (not on api.request).
• Optional resource cursor.user.id — do not require it on every record.

Delivery and auth

• Metrics: at-most-once, delta temporality. Sum deltas per series.
• Logs: at-least-once. No backfill from before the destination existed.
• Editing endpoint or credentials keeps the destination (takes ~30 seconds). Disabling or deleting drops in-flight data — rotate by editing, not delete-and-recreate.
• No prompt content, no OpenTelemetry trace_id / span_id. Cursor does not send traces.
• cursor.cost.usage is a best-effort estimate, not an invoice.

Pitfalls

• Action Recording off → no cursor.grok_bot.* events, even with export enabled.
• Putting /v1/metrics in the base URL breaks path append — use the host base only.
• Allowlist-only firewalls that miss the six Cursor egress IPs will fail Test connection.
• Audit Log page will not show Bot actions; wire OpenTelemetry Export (and Action Recording) for that path.