Configure TLS-inspecting proxies for Grok Bot

The Grok Bot desktop app reaches Cursor’s API on *.cursor.sh and the member’s hosted computer on nested *.*.cursorvm.com hostnames. Secure web gateways that inspect TLS often allow chat and still break computer setup. Official IT guide: Configure TLS-inspecting proxies. Related member troubleshooting: Fix Zscaler SSL blocking the Grok Bot computer.

This page is the gateway playbook for IT. It does not change Network Controls on the hosted computer or private-network Team Setup.

Symptoms

• Computer setup hangs or fails while chat may still work.
• Works on a hotspot or personal device; fails on the corporate network or with the gateway client running.
• Works in the office; fails at home on the same laptop (off-network / roaming profile missing the exceptions).
• Sign-in or chat stall too — inspection or buffering still active on cursor.sh.

Allow these domain patterns

Prefer wildcards. Computer hostnames are generated per computer.

Pattern	Used for
*.cursor.sh	Chat, sign-in, approvals, Cursor API
*.cursor-cdn.com	Static assets
*.cursorapi.com	Extension marketplace and related APIs
*.cursorvm.com	Hosted computer and control plane
*.*.cursorvm.com	Nested computer hostnames — required
cursor.com, downloads.cursor.com	Install and update

Add both cursorvm.com patterns. A single-level *.cursorvm.com allowlist looks correct and still leaves ..cursorvm.com hostnames unreachable — the usual cause of computer setup failing when cursor.sh already works.

Exempt TLS inspection and buffering

On every domain above:

1. Bypass TLS (SSL) inspection. Gateway re-signing breaks the computer setup handshake.
2. Turn off response buffering. Chat and the computer link stream; holding responses leaves the app waiting forever.

If policy forbids exemptions, the gateway must pass HTTP/2 (or Cursor’s HTTP/1.1 fallback), Server-Sent Events without buffering, and long-lived connections without forced timeouts (see Cursor’s Enterprise network / SSL inspection guidance linked from the proxies page).

Apply to every profile

Zscaler Client Connector (and similar clients) keep running off-network with a separate profile. Apply allow rules, TLS exemptions, and DNS exceptions to every location, profile, and policy group members use — including roaming and off-network.

Verify from a member device

With the gateway client running, after IT applies changes:

# Issuer should be Amazon RSA — not Zscaler / your gateway vendor
curl -v https://api2.cursor.sh |& grep -C1 issuer:

# Nested computer DNS must resolve
nslookup test.us9.cursorvm.com

If default DNS fails but nslookup test.us9.cursorvm.com 1.1.1.1 works, the nested *.*.cursorvm.com exception is missing on that device’s DNS or gateway profile.

Run Cursor’s HTTP/1.1 and HTTP/2 streaming tests (Enterprise network configuration → Testing proxy connectivity). Output should arrive line by line. Then reopen Grok Bot on the same device and connect to the computer.

Scope map

Goal	Control
Member devices reach Cursor + hosted computer through your gateway	This page
Limit destinations the hosted computer may reach	Network Controls (Enterprise)
Route hosted computer traffic through a member device	Route egress through this desktop
Install a networking client on every hosted computer	Team Setup / private networks (Enterprise)

By default, hosted-computer egress uses Cursor’s shared static ranges and does not pass through the member-device gateway.

Pitfalls

• Allowlisting only *.cursorvm.com and skipping *.*.cursorvm.com.
• Allowlisting hostnames but leaving TLS inspection on.
• Fixing the office profile only — home / roaming still fails.
• Confusing this path with Network Controls or private-network Team Setup.