--- title: AI coding agent audit: Cursor hooks and Elastic Agent —... description: Elastic Security Labs built a 280-line dependency-free bash script triggered by Cursor's lifecycle hooks to log every AI coding agent tool call (shell... canonical: https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI coding agent audit: Cursor hooks and Elastic Agent — Elastic Security Labs | daily.dev og:description: Elastic Security Labs built a 280-line dependency-free bash script triggered by Cursor's lifecycle hooks to log every AI coding agent tool call (shell... og:url: https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd og:image: https://api.daily.dev/og/posts/o2kaV0NBD.png og:image:alt: AI coding agent audit: Cursor hooks and Elastic Agent — Elastic Security Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI coding agent audit: Cursor hooks and Elastic Agent — Elastic Security Labs **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 18 min read · 0 upvotes · 0 comments ## Summary Elastic Security Labs built a 280-line dependency-free bash script triggered by Cursor's lifecycle hooks to log every AI coding agent tool call (shell commands, file reads/edits, MCP calls) as JSONL, shipped via the already-deployed Elastic Agent into Elasticsearch. Since a May rollout, the pipeline has captured over 13 million tool-call events from more than 1,100 machines and nearly 900 users, enabling ES|QL hunting queries for things like credential file access or curl-pipe-to-shell patterns. The post covers hook configuration gotchas, a self-installing distribution trick for unmanaged Linux machines via Cursor's enterprise Cloud Distribution, privacy/hardening decisions (field-level security, metadata-only logging), and the limitations of hook-based auditing (tamper-evident not tamper-proof, no visibility into prompts or model reasoning). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I log every tool call Cursor's AI agent makes, including shell commands and file reads? Register a script against Cursor's lifecycle hooks (beforeShellExecution, afterFileEdit, beforeReadFile, beforeMCPExecution, etc.) defined in hooks.json, which Cursor invokes with a JSON payload on stdin for each event. A sensor-only script can immediately respond {"permission":"allow"} to blocking hooks, then append the parsed event as one JSONL line, promoting fields like tool_name, command, file_path, and mcp_server to the top level for easy querying. _Developers wiring up agent observability pipelines can compare hook-based approaches like this on daily.dev._ ### Why does Cursor's hooks.json config not work after I deploy it via MDM to /Library/Application Support/? Cursor splits hook command paths on spaces, so a script located under a path containing a space (like /Library/Application Support/) will silently never execute. The fix is keeping the executable script itself at a space-free path such as /usr/local/share/ai-hooks/, while only the hooks.json config file lives inside the Cursor application support directory. Additionally, Cursor only reads hooks.json at startup, so deployed machines stay silent until Cursor restarts. _Anyone debugging silent AI agent hook deployments can track gotchas like this on daily.dev._ ### What do coding agents like Cursor actually spend most of their tool calls doing, shell commands or file reads? File reads dominate over shell command execution by roughly four to one across a fleet of over 1,100 machines generating 13 million tool-call events. This contradicts the intuitive assumption that agents mostly run commands; in practice most agent activity is reconnaissance of the existing codebase, reading files before taking any action. _Teams evaluating how AI coding agents actually behave in practice can dig into data like this on daily.dev._ ## Similar posts on daily.dev - [Hooks for security and platform teams](https://daily.dev/posts/hooks-for-security-and-platform-teams-tzbe2g3vh) · Cursor · 1 upvotes · 0 comments - [Elastic and Cursor partner to accelerate context engineering with coding agents](https://daily.dev/posts/elastic-and-cursor-partner-to-accelerate-context-engineering-with-coding-agents-6dddpoycp) · elastic · 1 upvotes · 0 comments - [Cursor built a fleet of security agents to solve a familiar frustration](https://daily.dev/posts/cursor-built-a-fleet-of-security-agents-to-solve-a-familiar-frustration-yedwfqsbz) · The New Stack · 1 upvotes · 0 comments - [Cursor Agent Hooks: Lint and Build Checks After Each Turn](https://daily.dev/posts/cursor-agent-hooks-lint-and-build-checks-after-each-turn-aegcnriet) · Liran Tal · 1 upvotes · 0 comments --- Tags: [#observability](https://daily.dev/tags/observability), [#mcp](https://daily.dev/tags/mcp), [#elk](https://daily.dev/tags/elk) [View this post on daily.dev](https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI coding agent audit: Cursor hooks and Elastic Agent — Elastic Security Labs","url":"https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd"},"datePublished":"2026-08-13T08:20:21.224Z","dateModified":"2026-08-13T08:20:52.692Z","description":"Elastic Security Labs built a 280-line dependency-free bash script triggered by Cursor's lifecycle hooks to log every AI coding agent tool call (shell...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55b368e4d058101a6f7a02866bbf971c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55b368e4d058101a6f7a02866bbf971c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Elastic Security Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Elastic Security Labs","logo":"https://media.daily.dev/image/upload/s--48fjDVq1--/c_limit,w_256/f_auto,q_auto/v1780213343/logos/elastic-security-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/elastic-security-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"observability,mcp,elk","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Elastic Security Labs","item":"https://daily.dev/sources/elastic-security-labs"},{"@type":"ListItem","position":3,"name":"AI coding agent audit: Cursor hooks and Elastic Agent — Elastic Security Labs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-coding-agent-audit-cursor-hooks-and-elastic-agent-elastic-security-labs-o2kav0nbd#faq","mainEntity":[{"@type":"Question","name":"How do I log every tool call Cursor's AI agent makes, including shell commands and file reads?","acceptedAnswer":{"@type":"Answer","text":"Register a script against Cursor's lifecycle hooks (beforeShellExecution, afterFileEdit, beforeReadFile, beforeMCPExecution, etc.) defined in hooks.json, which Cursor invokes with a JSON payload on stdin for each event. A sensor-only script can immediately respond {\"permission\":\"allow\"} to blocking hooks, then append the parsed event as one JSONL line, promoting fields like tool_name, command, file_path, and mcp_server to the top level for easy querying. Developers wiring up agent observability pipelines can compare hook-based approaches like this on daily.dev."}},{"@type":"Question","name":"Why does Cursor's hooks.json config not work after I deploy it via MDM to /Library/Application Support/?","acceptedAnswer":{"@type":"Answer","text":"Cursor splits hook command paths on spaces, so a script located under a path containing a space (like /Library/Application Support/) will silently never execute. The fix is keeping the executable script itself at a space-free path such as /usr/local/share/ai-hooks/, while only the hooks.json config file lives inside the Cursor application support directory. Additionally, Cursor only reads hooks.json at startup, so deployed machines stay silent until Cursor restarts. Anyone debugging silent AI agent hook deployments can track gotchas like this on daily.dev."}},{"@type":"Question","name":"What do coding agents like Cursor actually spend most of their tool calls doing, shell commands or file reads?","acceptedAnswer":{"@type":"Answer","text":"File reads dominate over shell command execution by roughly four to one across a fleet of over 1,100 machines generating 13 million tool-call events. This contradicts the intuitive assumption that agents mostly run commands; in practice most agent activity is reconnaissance of the existing codebase, reading files before taking any action. Teams evaluating how AI coding agents actually behave in practice can dig into data like this on daily.dev."}}]} ```