Documentation 2026-10-12 23:02 UTC to 2026-10-13 23:59 UTC

79For passwords, passkeys, two-factor codes, CAPTCHAs, and payment confirmations,79For passwords, passkeys, two-factor codes, CAPTCHAs, and payment confirmations,

80the Bot should hand you control of the computer.80the Bot should hand you control of the computer.

81 81 

821. Open **Agent Computer**.821. Choose **Take over** on the request in the conversation, or open the

832. Take control.83 computer and choose **Take control**.

843. Complete the sensitive step.842. Complete the sensitive step.

854. Return control and tell the Bot to continue.853. Choose **I'm done**, then tell the Bot to continue.

86 86 

87Do not send a password or one-time code in ordinary chat.87Do not send a password or one-time code in ordinary chat.

88 88 

57* **Pin** active Bots to keep them at the top of the sidebar.57* **Pin** active Bots to keep them at the top of the sidebar.

58* **Hide from sidebar** removes a Bot from the main list without deleting its58* **Hide from sidebar** removes a Bot from the main list without deleting its

59 work.59 work.

60* Open **Hidden Bots** at the bottom of the sidebar (when every Bot is hidden,60* Open **Hidden Bots** at the bottom of the sidebar and choose **Show in

61 the sidebar shows **Show Hidden Bots** instead), then choose **Unhide** to61 sidebar** from the Bot's menu. On iPhone and Android, choose **Unhide** in

62 restore a hidden Bot.62 the hidden Bots list; when every Bot is hidden, the home screen shows **Show

63 Hidden Bots**.

63 64 

64Hiding does not pause the Bot or its routines.65Hiding does not pause the Bot or its routines.

65 66 

26 26 

27## Watch computer work27## Watch computer work

28 28 

29Open **Agent Computer** from a conversation to view the shared desktop. The29Open the computer from a conversation to view the shared desktop. The preview

30preview shows clicks, typing, navigation, and current status.30shows clicks, typing, navigation, and current status.

31 31 

32You can leave the preview while work continues. Closing the Grok Bot app or32You can leave the preview while work continues. Closing the Grok Bot app or

33your laptop does not stop cloud work.33your laptop does not stop cloud work.

103When the computer is unreachable, use **Recover computer** from the error state103When the computer is unreachable, use **Recover computer** from the error state

104(the confirmation dialog calls it **Recover Grok Bot's Computer**). Recovery is104(the confirmation dialog calls it **Recover Grok Bot's Computer**). Recovery is

105offered only there, not in Settings. For planned maintenance or last-resort105offered only there, not in Settings. For planned maintenance or last-resort

106recovery, open **Settings → Updates** and use the **Grok Bot's Computer**106recovery, open **Settings → Computer** and use the controls under **Bot's

107controls:107computer**:

108 108 

109* **Update** installs the latest software on the computer and keeps your files109* **Update Bot's Computer** installs the latest software on the computer and

110 in place.110 keeps your files in place.

111* **Reset** rebuilds the computer from your last saved snapshot; very recent111* **Reset Bot's Computer** rebuilds the computer from your last saved

112 changes may be lost.112 snapshot; very recent changes may be lost.

113 113 

114Wait for active work to finish before recovery when possible. See114Wait for active work to finish before recovery when possible. See

115[Troubleshooting](/grok-bot/troubleshooting) for the least-destructive order.115[Troubleshooting](/grok-bot/troubleshooting) for the least-destructive order.

76 none of the selected members are still on the team, shows **Not Started**76 none of the selected members are still on the team, shows **Not Started**

77 with the reason and changes nothing.77 with the reason and changes nothing.

78 78 

79## Run operations through the API

80 

81Organization admins can recreate, terminate, or delete members' computers from

82a script with the Organization API. Send a team, a list of members, and an

83action, then poll the operation for its counts and, for operations of up to

841,000 members, a result for each member. The API and the dashboard share the

85limit of one operation per team, so a start from either one fails while

86another operation for that team is running.

87 

88The API needs an Organization API key with the `admin:*` scope. For the

89endpoints, request fields, and error codes, see

90[Grok Bot computers](https://cursor.com/docs/account/organizations/organization-admin-api#grok-bot-computers)

91in the Organization API reference.

92 

79## Skipped and failed members93## Skipped and failed members

80 94 

81A finished operation lists a result for every member you selected.95A finished operation lists a result for every member you selected.

1#### Manage and protect

2 

3# Deploy Grok Bot to your organization

4 

5Your IT team installs the Grok Bot desktop app on member devices with the tools

6it already uses for other software: download a versioned installer, push it,

7and decide when devices move to a new release. Dashboard controls for turning

8Grok Bot on and scoping access are on

9[Grok Bot for teams and enterprises](/grok-bot/teams-and-enterprises).

10 

11## What you deploy

12 

13| Component | Runs on | Updated by |

14| --- | --- | --- |

15| Desktop app | macOS (Apple silicon and Intel), Windows (x64 and Arm64), Linux (x64 and Arm64) | The app, or your package manager for Linux `.deb` and `.rpm` installs |

16| iPhone app | iOS 18 or later | The App Store |

17| Android app | Android 9 or later | Google Play |

18| Hosted computer | The cloud, one per member | Automatically, in the background |

19 

20The apps are clients for chat, review, and approvals. Bots do their work on the

21member's hosted computer. Your device management tool reaches the apps on

22member devices and stops there: the hosted computer runs Linux in the cloud and

23isn't enrolled in MDM. To put your own tooling on hosted computers, Enterprise

24teams use

25[Team Setup scripts](/grok-bot/private-networks#install-a-networking-client-with-team-setup).

26 

27## Get the installers

28 

29* The **Download Grok Bot** row on the

30 [Grok Bot page](https://cursor.com/dashboard/bot) of the dashboard installs

31 the app or copies a link you can share with members.

32* The [download page](https://cursor.com/download/bot) lists the current

33 installer for every platform and format.

34* For scripted packaging, read the current release from the

35 [release feed](#read-the-current-release-from-the-feed) and download the file

36 it names.

37 

38| Platform | Architectures | Formats |

39| --- | --- | --- |

40| macOS | Apple silicon, Intel | `.dmg` |

41| Windows | x64, Arm64 | Setup `.exe` |

42| Linux | x64, Arm64 | `.deb`, `.rpm`, AppImage |

43 

44### Read the current release from the feed

45 

46Each platform has a JSON feed at

47`https://api2.cursor.sh/updates/api/download/stable/{platform}/sand`:

48 

49| `{platform}` | Installer |

50| --- | --- |

51| `darwin-arm64` | macOS, Apple silicon |

52| `darwin-x64` | macOS, Intel |

53| `win32-x64-user` | Windows x64 |

54| `win32-arm64-user` | Windows Arm64 |

55| `linux-x64` | Linux x64 |

56| `linux-arm64` | Linux Arm64 |

57 

58```bash

59curl -s https://api2.cursor.sh/updates/api/download/stable/darwin-arm64/sand

60```

61 

62The fields you need:

63 

64| Field | Value |

65| --- | --- |

66| `version` | The current release |

67| `commitSha` | The build the release comes from. Linux download URLs include it. |

68| `downloadUrl` | The installer: `.dmg` on macOS, Setup `.exe` on Windows, AppImage on Linux |

69| `debUrl`, `rpmUrl` | Linux only. The `.deb` and `.rpm` packages. |

70 

71The response can carry other fields; installing the desktop app doesn't need

72them.

73 

74### Build a versioned URL

75 

76macOS and Windows installers keep a versioned URL for each release. Replace

77`{version}` with the release you want:

78 

79```text

80# macOS, Apple silicon

81https://downloads.cursor.com/grokbot/stable/darwin-arm64/{version}/Grok_Bot_{version}.dmg

82 

83# macOS, Intel

84https://downloads.cursor.com/grokbot/stable/darwin-x64/{version}/Grok_Bot_{version}_x64.dmg

85 

86# Windows x64

87https://downloads.cursor.com/grokbot/stable/win32-x64/{version}/Grok_Bot_{version}_Setup.exe

88 

89# Windows Arm64

90https://downloads.cursor.com/grokbot/stable/win32-arm64/{version}/Grok_Bot_{version}_Setup.exe

91```

92 

93Linux packages sit under the release's `commitSha`, in

94`https://downloads.cursor.com/grokbot/stable/{commitSha}/linux/x64/` or

95`.../linux/arm64/`. Copy the exact file URLs from `downloadUrl`, `debUrl`, and

96`rpmUrl` in the Linux feed.

97 

98## Push the desktop app with your device management tool

99 

100* On macOS, deploy the `.dmg` with the Mac management tool you run today, such

101 as Jamf Pro, Kandji, or Microsoft Intune.

102* On Windows, deploy the Setup `.exe` with Intune, Configuration Manager, or

103 another software distribution tool, and install silently with

104 `Grok_Bot_{version}_Setup.exe /S`. The installer installs per user, into the

105 member's profile under `%LOCALAPPDATA%\Programs`, so deploy it in user

106 context, not as SYSTEM. Test the install on a pilot device before you push

107 it.

108* On Linux, install the `.deb` or `.rpm` with your configuration management

109 tool, such as Ansible, Puppet, or Chef. Prefer these packages for managed

110 fleets: package installs update through your package manager on your

111 schedule. See [Linux package updates](#linux-package-updates).

112* On iPhone, members install Grok Bot from the

113 [App Store](https://apps.apple.com/app/id6794501026) on iOS 18 or later.

114* On Android, members install Grok Bot from

115 [Google Play](https://play.google.com/store/apps/details?id=ai.x.grok.bot) on

116 Android 9 or later. To push it to managed devices, approve it in managed

117 Google Play from Intune or another Android device management tool.

118 

119Members sign in through your normal SSO flow; Grok Bot has no separate login.

120To assign the Cursor app in Okta or Entra ID, see

121[Assign the Cursor app](/grok-bot/identity-and-access#assign-the-cursor-app).

122 

123## Choose a version

124 

125Pin the version you tested. Download that release's installer, keep it in your

126own software repository or MDM package store, and deploy from your copy so

127every new device gets the same build. How long older installers stay available

128for download isn't published, and a pinned build works only until it loses

129support; see [How desktop updates work](#how-desktop-updates-work).

130 

131Linux package URLs include the release's `commitSha`, so record the full URL

132along with the version.

133 

134To check what a device runs, open the account menu in the app, choose

135**Support**, then **About**. The dialog shows **Version**, and **Copy version

136info** copies the version, release track, and operating system.

137 

138### How desktop updates work

139 

140| Install | How updates arrive |

141| --- | --- |

142| macOS `.dmg`, Windows Setup `.exe`, Linux AppImage | The app checks for updates automatically and offers each new version to the member. **Restart to Update**, in the [Updates](/grok-bot/settings-and-notifications#updates) section of settings, installs it. |

143| Linux `.deb` or `.rpm` | The app doesn't install updates. New versions arrive through your package manager. |

144 

145For macOS, Windows, and AppImage installs, no device policy, installer option,

146or dashboard setting turns off desktop app updates. Pinning decides which

147version you install; the app still offers newer ones afterward.

148 

149Old builds stop working. When a build loses support, the app covers its whole

150window with **Update required** until the member updates. A build loses support

151when it falls below the minimum supported version, or when it passes a maximum

152age and a newer release is available. This applies to every install, including

153Linux `.deb` and `.rpm` packages. Both limits are set remotely and aren't

154published, so plan a regular cadence for moving devices to the current release.

155 

156### Linux package updates

157 

158Installing the `.deb` adds a signed apt repository at

159`/etc/apt/sources.list.d/grok-bot.sources`, and installing the `.rpm` adds a

160signed repository at `/etc/yum.repos.d/grok-bot.repo`. Devices then pick up new

161Grok Bot versions whenever they run package upgrades.

162 

163To control when Linux devices move, either:

164 

165* Hold the package with your package manager, such as

166 `apt-mark hold grok-bot`, and release it when you're ready to upgrade.

167* Turn the repository off: set `Enabled: no` in `grok-bot.sources`, or

168 `enabled=0` in `grok-bot.repo`. The package rewrites these files on every

169 install and upgrade and keeps your choice. Then ship new versions yourself

170 from package files you've tested.

171 

172Either way, upgrade before the installed version loses support. A held package

173still gets the **Update required** screen.

174 

175## Update the hosted computers

176 

177The hosted computer's image is maintained for you, so there is no image for you

178to pin or supply. A computer moves to a newer image in one of three ways:

179 

180| Trigger | What happens | Who starts it |

181| --- | --- | --- |

182| New image | Idle computers are recreated on the new image in the background, gradually and without a fixed schedule. Until then, a computer stays on its current image. Member files carry over, and Team Setup runs again. | Automatic, in the background |

183| **Update Bot's Computer** | Rebuilds the member's computer on the latest image. | The member, from **Settings → Computer** in the desktop app, under **Bot's computer** |

184| **Recreate VMs** | Rebuilds the selected members' computers on the latest image and Team Setup scripts. | Organization admins on Enterprise, from [Manage Bot Computers](/grok-bot/computers) |

185 

186Running computers pick up Team Setup manifest changes roughly once a day; to

187apply a change sooner, recreate the computers. On Enterprise,

188[audit logs](/grok-bot/teams-and-enterprises#audit-logs) record computer

189updates, resets, recreates, and terminations as `grok_bot_vm` events, and

190operations across many members as `grok_bot_vm_bulk`.

191 

192## Open the network path

193 

194Devices download installers and desktop updates from `cursor.com` and

195`downloads.cursor.com`, and the app reaches its API and the member's hosted

196computer on the domains in

197[Allow these domain patterns](/grok-bot/proxies#allow-these-domain-patterns).

198Allow all of them, including the nested `*.*.cursorvm.com` pattern, and exempt

199them from TLS inspection before you push the app.

200 

201## Rollout checklist

202 

2031. Move off Privacy Mode (Legacy), which blocks Grok Bot entirely. See

204 [Before you roll out](/grok-bot/teams-and-enterprises#before-you-roll-out).

2052. Clear your network: allow the Grok Bot domains on your gateway and exempt

206 them from TLS inspection. See

207 [Configure TLS-inspecting proxies](/grok-bot/proxies).

2083. Assign the Cursor app in your identity provider, since Grok Bot sign-in uses

209 your SSO. See

210 [Assign the Cursor app](/grok-bot/identity-and-access#assign-the-cursor-app).

2114. Turn on Grok Bot and choose who gets it. On Enterprise, an admin turns Grok

212 Bot on from the dashboard and scopes it with **Manage Group Access**; on

213 Teams, every member already has access. See

214 [Enabling Grok Bot for your team](/grok-bot/teams-and-enterprises#enabling-grok-bot-for-your-team).

2155. Set the admin controls in

216 [Recommended configuration](/grok-bot/teams-and-enterprises#recommended-configuration)

217 before members start.

2186. Pilot the installer: install your chosen version on a few devices for each

219 platform, sign in, and confirm the app connects to the hosted computer.

2207. Deploy the tested installer to every device whose owner has access.

2218. Pick a cadence for moving devices to new releases. For Linux, decide whether

222 devices upgrade from the Grok Bot repository or from packages you ship.

223 

224## FAQ

225 

226### Can I turn off automatic updates for the desktop app?

227 

228On macOS, Windows, and AppImage installs, no. The app checks for updates and

229offers them to members. Linux `.deb` and `.rpm` installs don't update

230themselves, so you control them with your package manager. See

231[How desktop updates work](#how-desktop-updates-work).

232 

233### Is there an MSI or PKG installer?

234 

235The published installers are a `.dmg` for macOS, a Setup `.exe` for Windows,

236and a `.deb`, `.rpm`, or AppImage for Linux. Wrap the `.dmg` or `.exe` in your

237management tool's package format if it requires one.

238 

239### Does my device management tool reach the hosted computer?

240 

241No. The hosted computer runs Linux in the cloud and isn't enrolled in MDM.

242Enterprise teams install their own tooling on it with

243[Team Setup](/grok-bot/private-networks). If your identity provider requires a

244managed device, see

245[Allow sign-in to IdP apps from the computer](/grok-bot/identity-and-access#allow-sign-in-to-idp-apps-from-the-computer).

246 

247### Can I pin the hosted computer's image?

248 

249No. The image is maintained for you, and computers move to new images in the

250background. Enterprise organization admins can recreate computers at a time

251they choose from [Manage Bot Computers](/grok-bot/computers).

252 

253### Can members install Grok Bot without IT?

254 

255Yes, unless your device policies block it. Members can download the app from

256the dashboard link an admin shares or from the

257[download page](https://cursor.com/download/bot). Access still depends on your

258plan and, on Enterprise, on **Manage Group Access**.

259 

260## Related pages

261 

262* [Grok Bot for teams and enterprises](/grok-bot/teams-and-enterprises)

263* [Configure identity and access](/grok-bot/identity-and-access)

264* [Connect to private networks](/grok-bot/private-networks)

265* [Configure TLS-inspecting proxies](/grok-bot/proxies)

266* [Manage Grok Bot computers](/grok-bot/computers)

267* [Settings and notifications](/grok-bot/settings-and-notifications#updates)

268 

269Contact your account team about Enterprise enablement, deployment planning, and

270security review support.

141When the Bot reaches an app that requires authentication, it may ask you to141When the Bot reaches an app that requires authentication, it may ask you to

142take over the computer.142take over the computer.

143 143 

1441. Open **Agent Computer** from the conversation.1441. Choose **Take over** on the request in the conversation.

1452. Choose the takeover control.1452. Enter the password, passkey, two-factor code, or complete the CAPTCHA

1463. Enter the password, passkey, two-factor code, or complete the CAPTCHA

147 yourself.146 yourself.

1484. Return control to the Bot.1473. Choose **I'm done** to hand control back.

149 148 

150The browser session persists on your shared Grok Bot computer, so other Bots149The browser session persists on your shared Grok Bot computer, so other Bots

151can use the same signed-in session when appropriate.150can use the same signed-in session when appropriate.

84* Watch browser or desktop work84* Watch browser or desktop work

85* Take over for a password, two-factor code, or CAPTCHA85* Take over for a password, two-factor code, or CAPTCHA

86* Inspect the current screen86* Inspect the current screen

87* Return control to the Bot87* Hand control back with **I'm done**

88 88 

89The screen is the same shared computer used by every Bot on your account.89The screen is the same shared computer used by every Bot on your account.

90 90 

42In the Grok Bot desktop app, open **Settings → Computer → Network** and turn on42In the Grok Bot desktop app, open **Settings → Computer → Network** and turn on

43**Route traffic through this computer**. The route uses the current device's43**Route traffic through this computer**. The route uses the current device's

44network and IP address. It stops when the setting is turned off or an Enterprise44network and IP address. It stops when the setting is turned off or an Enterprise

45admin disables **Allow Local Egress**.45admin disables **Allow Local Egress Routing**.

46 46 

47Each member controls their own desktop route. Enterprise admins can remove this47Each member controls their own desktop route. Enterprise admins can remove this

48option for the whole team from48option for the whole team from

12> **Enterprise only** on the Grok Bot dashboard: the organization-wide enable12> **Enterprise only** on the Grok Bot dashboard: the organization-wide enable

13> switch, **Network Controls**, **Team Setup**,13> switch, **Network Controls**, **Team Setup**,

14> [**Team Secrets**](/grok-bot/teams-and-enterprises#team-secrets),14> [**Team Secrets**](/grok-bot/teams-and-enterprises#team-secrets),

15> **Action Recording**, **Allow Local Egress**, **Enforce Auto-review** with15> **Action Recording**, **Allow Local Egress Routing**,

16> its team rules, and computer management for organization admins. Audit logs,16> **Allow Sudo on Bot Computers**, **Enforce Auto-review** with its team rules,

17> and computer management for organization admins. Audit logs,

17> OpenTelemetry Export, the MCP allowlist, and SCIM are also Enterprise only.18> OpenTelemetry Export, the MCP allowlist, and SCIM are also Enterprise only.

18> Self-serve Teams do not see those settings. The full list is under19> Self-serve Teams do not see those settings. The full list is under

19> [admin controls](/grok-bot/teams-and-enterprises#admin-controls).20> [admin controls](/grok-bot/teams-and-enterprises#admin-controls).

28 29 

29| Mode | Effect |30| Mode | Effect |

30| --- | --- |31| --- | --- |

31| **No Policy (Allow All)** | Allow all (the default for teams without a policy) |32| **Allow All Network Access** | Allow all destinations (what teams without a policy get) |

32| **Allow All Network Access** | Explicitly allow all destinations |

33| **Defaults + Team Allowlist** | Cursor's default destinations plus your list |33| **Defaults + Team Allowlist** | Cursor's default destinations plus your list |

34| **Team Allowlist Only** | Only your list, plus the destinations a computer needs to function |34| **Team Allowlist Only** | Only your list, plus the destinations a computer needs to function |

35 35 

37 connections, with no cap on the number of entries.37 connections, with no cap on the number of entries.

38* **Directory groups. Enterprise only, inside Network Controls.** Groups can38* **Directory groups. Enterprise only, inside Network Controls.** Groups can

39 set their own network policy, which replaces the team's for their members,39 set their own network policy, which replaces the team's for their members,

40 and a lock makes the team policy effective for everyone.40 and a lock makes the team policy effective for everyone. A member of several

41 groups gets the most restrictive group policy.

41* **The policy is separate from Cloud Agent network settings.** Running42* **The policy is separate from Cloud Agent network settings.** Running

42 computers apply changes automatically within about a minute. Sleeping43 computers apply changes automatically within about a minute. Sleeping

43 computers apply changes when they next wake. You do not need to recreate the44 computers apply changes when they next wake. You do not need to recreate the

54only and applies to the whole organization. Cloud Agents, Team Rules, and54only and applies to the whole organization. Cloud Agents, Team Rules, and

55public template sharing apply to the whole team on Teams and Enterprise.55public template sharing apply to the whole team on Teams and Enterprise.

56Enforce Auto-review and Auto-review rules are Enterprise only and also apply56Enforce Auto-review and Auto-review rules are Enterprise only and also apply

57to the whole team. Allow Local Egress is Enterprise only and applies to the57to the whole team. Allow Local Egress Routing is Enterprise only and applies to

58whole team. On Enterprise, a group's Grok Bot tab can widen Cloud Agents, local58the whole team. On Enterprise, a group's Grok Bot tab can widen Cloud Agents, local

59execution, local egress, Auto-review, rules, and setup scripts for that group's59execution, local egress, Auto-review, rules, and setup scripts for that group's

60members, never tighten them. See60members, never tighten them. See

61[Group settings](/grok-bot/teams-and-enterprises#group-settings).61[Group settings](/grok-bot/teams-and-enterprises#group-settings).

69 69 

70### Route traffic through your desktop70### Route traffic through your desktop

71 71 

72Turn on **Route egress through this desktop** to send your Grok Bot computer's72Turn on **Route traffic through this computer** to send your Grok Bot

73web traffic through the current desktop. Destinations see your desktop's IP73computer's web traffic through the current desktop. Destinations see your

74address, and the Bot can reach networks available from that device.74desktop's IP address, and the Bot can reach networks available from that

75device.

75 76 

76The setting applies to one desktop. If your Enterprise admin turns off **Allow77The setting applies to one desktop. If your Enterprise admin turns off **Allow

77Local Egress**, the toggle turns off and locks with78Local Egress Routing**, the toggle turns off and locks. The setting reads

78`Your team's admin has turned off local egress.` Any active route stops within79`Your team admin has turned off local traffic routing. Grok Bot's computer routes traffic through the cloud.`

79five minutes. Your choice is preserved and takes effect again if the admin80and the switch shows `Disabled by your admin. You can't turn this on.` Any

80re-allows local egress.81active route stops within five minutes. Your choice is preserved and takes

82effect again if the admin re-allows local egress.

81 83 

82For private network options and their tradeoffs, see84For private network options and their tradeoffs, see

83[Connect to private networks](/grok-bot/private-networks).85[Connect to private networks](/grok-bot/private-networks).

84 86 

87### Update or reset Bot's computer

88 

89Under **Bot's computer**, **Update Bot's Computer** installs the latest

90software on Grok Bot's computer and keeps your files in place. **Reset Bot's

91Computer** restarts the computer from your last saved snapshot, so very recent

92changes may be lost. Use it as a last resort.

93 

94See [Troubleshooting](/grok-bot/troubleshooting) for the least destructive

95recovery order.

96 

85## Plugins97## Plugins

86 98 

87Plugins are not a settings section. Open **Marketplace** from the sidebar to99Plugins are not a settings section. Open **Connect apps** from the sidebar to

88discover plugins and packaged skills. To review what you have installed, choose100discover plugins and packaged skills. To review what you have installed, choose

89**Your plugins** in Marketplace; **Manage plugins and skills** lists your101**Your plugins** in **Connect apps**; **Manage plugins and skills** lists your

90**Installed** plugins and your **Private skills**.102**Installed** plugins and your **Private skills**.

91 103 

92An installed plugin may still need browser authentication. Individual plugin104An installed plugin may still need browser authentication. Individual plugin

106For how plans, weekly usage, and on-demand spend work, see118For how plans, weekly usage, and on-demand spend work, see

107[Plans and billing](https://cursor.com/help/grok-bot/plans).119[Plans and billing](https://cursor.com/help/grok-bot/plans).

108 120 

109## Team Setup

110 

111Team Setup is Enterprise only. When an Enterprise admin provides a managed

112setup for your team's computers, **Team Setup** shows it here so you can review

113or reinstall it. Admins configure the manifests from the Cursor dashboard; see

114[Grok Bot for teams and enterprises](/grok-bot/teams-and-enterprises#admin-controls).

115 

116## Updates121## Updates

117 122 

118The update controls live in **Settings → Updates**. The Grok Bot app and Grok123**Settings → Updates** handles updates to the desktop app. **Grok Bot Updates**

119Bot's computer update separately:124shows the installed version; use **Check for Updates** and **Restart to

120 125Update** to install a new one. To update or reset Grok Bot's computer, see

121* **Grok Bot Updates** shows the installed version. **Check for Updates** and126[Update or reset Bot's computer](#update-or-reset-bots-computer).

122 **Restart to Update** update the desktop app.

123* Under **Grok Bot's Computer**, **Update** installs the latest software on the

124 cloud computer and keeps your files in place.

125* **Reset** wipes the computer and rebuilds it from your last saved snapshot, so

126 very recent changes may be lost. Use it as a last resort.

127 

128See [Troubleshooting](/grok-bot/troubleshooting) for the least destructive

129recovery order.

130 127 

131## Edit one Bot128## Edit one Bot

132 129 

335. What to return335. What to return

346. What requires approval346. What requires approval

35 35 

36Use **Marketplace** in the sidebar to discover and install supported connectors36Use **Connect apps** in the sidebar to discover and install supported

37and packaged skills. Type `/` in the desktop composer to reference a saved skill;37connectors and packaged skills. Type `/` in the desktop composer to reference a

38use `@` for Bots, groups, routines, and connectors.38saved skill; use `@` for Bots, groups, routines, and connectors.

39 39 

40Private skills are one library shared by all your Bots. If a skill does not40Private skills are one library shared by all your Bots. If a skill does not

41appear in the `/` menu, open **Marketplace → Your plugins → Manage plugins and41appear in the `/` menu, open **Connect apps → Your plugins → Manage plugins and

42skills** and check that it is listed under **Private skills**.42skills** and check that it is listed under **Private skills**.

43 43 

44## Teach a workflow by demonstration44## Teach a workflow by demonstration

43page. Existing Cursor users on your team get an email with a download link. New43page. Existing Cursor users on your team get an email with a download link. New

44users get an invitation to your Cursor team, by email or invite link, that also44users get an invitation to your Cursor team, by email or invite link, that also

45points them to Grok Bot. Teams that manage membership through SCIM see only the45points them to Grok Bot. Teams that manage membership through SCIM see only the

46existing-users option.46existing-users option. To install the apps on member devices with your own

47device management tools, see

48[Deploy Grok Bot to your organization](/grok-bot/deployment).

47 49 

48## Before you roll out50## Before you roll out

49 51 

81 an independent review model called Auto Review.83 an independent review model called Auto Review.

82* Administrative control. Team admins can set Team Rules, Cloud Agent84* Administrative control. Team admins can set Team Rules, Cloud Agent

83 delegation, template sharing, and the local execution ceiling. Network85 delegation, template sharing, and the local execution ceiling. Network

84 Controls, Team Setup, Team Secrets, Allow Local Egress, Action Recording,86 Controls, Team Setup, Team Secrets, Allow Local Egress Routing, Allow Sudo on

85 Enforce Auto-review, Auto-review rules, and the organization-wide enable87 Bot Computers, Action Recording, Enforce Auto-review, Auto-review rules, and

86 switch are Enterprise only.88 the organization-wide enable switch are Enterprise only.

87 89 

88The pieces fit together like this:90The pieces fit together like this:

89 91 

97 Rules, Cloud Agent delegation, public template sharing, and Execution on99 Rules, Cloud Agent delegation, public template sharing, and Execution on

98 Local Computer are available to team admins. Enterprise only on that page:100 Local Computer are available to team admins. Enterprise only on that page:

99 the organization-wide enable switch, Network Controls, Team Setup, Team101 the organization-wide enable switch, Network Controls, Team Setup, Team

100 Secrets, Allow Local Egress, Action Recording, Enforce Auto-review,102 Secrets, Allow Local Egress Routing, Allow Sudo on Bot Computers, Action

101 Auto-review rules, and computer management for organization admins. Members103 Recording, Enforce Auto-review, Auto-review rules, and computer management

102 never see this page.104 for organization admins. Members never see this page.

1033. The Bot. Shell, browser, and computer use inside the hosted computer. A Bot1053. The Bot. Shell, browser, and computer use inside the hosted computer. A Bot

104 has no access by default and acts only with accounts the member signs it106 has no access by default and acts only with accounts the member signs it

105 into. It hands login, two-factor authentication, and payment steps to the107 into. It hands login, two-factor authentication, and payment steps to the

163 165 

164Available on the Enterprise plan.166Available on the Enterprise plan.

165 167 

166### Agent capabilities168### Bot Capabilities

167 169 

168What Bots may do on behalf of members. Each control applies to every member's170What Bots may do on behalf of members. Each control applies to every member's

169Bots.171Bots.

176on separate computers under your existing Cloud Agent controls. Turn it off178on separate computers under your existing Cloud Agent controls. Turn it off

177when your team does not need delegation.179when your team does not need delegation.

178 180 

181#### Agent Email

182 

183Lets members claim an agent email address and lets their Bots read and send

184mail from it. The switch is on the Grok Bot page and is off by default, and

185members get no email tools until it is on. If you turn it off later, Bots lose

186their email tools and email routines stop.

187 

179#### Public template sharing188#### Public template sharing

180 189 

181Controls whether members can publish Bot templates outside your team. Off190Controls whether members can publish Bot templates outside your team. Off

208specific reason to work on member machines. See217specific reason to work on member machines. See

209[local execution](/grok-bot/security#local-execution).218[local execution](/grok-bot/security#local-execution).

210 219 

211#### Allow Local Egress220#### Allow Local Egress Routing

212 221 

213Let members route Grok Bot's web traffic through their own computer. Off222Let members route Grok Bot's web traffic through their own computer. Off

214disables the option in Grok Bot. The switch is on by default. Turning it off223disables the option in Grok Bot. The switch is on by default. Turning it off

218 227 

219Available on the Enterprise plan.228Available on the Enterprise plan.

220 229 

230#### Allow Sudo on Bot Computers

231 

232Lets Bots run commands as root on their own computer. The switch is on by

233default and sits next to **Allow Local Egress Routing** in the **Bot

234Computers** section of the Grok Bot page. Existing computers must be restarted

235before a change takes effect; see

236[Restart after a settings change](/grok-bot/computers#restart-after-a-settings-change).

237 

238Available on the Enterprise plan.

239 

221### Rules and approvals240### Rules and approvals

222 241 

223Guidance Bots follow, and the review layer that stops actions.242Guidance Bots follow, and the review layer that stops actions.

262 281 

263Restricts which destinations team computers can reach. On the dashboard the282Restricts which destinations team computers can reach. On the dashboard the

264section is **Network** and the control is **Grok Bot Network Access**. Pick one283section is **Network** and the control is **Grok Bot Network Access**. Pick one

265of four modes, from allow-all to a team allowlist of domains and IP ranges:284of three modes, from allow-all to a team allowlist of domains and IP ranges:

266**No Policy (Allow All)**, **Allow All Network Access**, **Defaults + Team285**Allow All Network Access**, **Defaults + Team Allowlist**, or **Team

267Allowlist**, or **Team Allowlist Only**. Directory groups can carry their own286Allowlist Only**. Directory groups can carry their own

268policy as **Group Network Access**, and **Lock for All Groups** makes the team287policy as **Group Network Access**, and **Lock for All Groups** makes the team

269policy apply to everyone. Teams without a policy default to allow-all. See288policy apply to everyone. Teams without a policy default to allow-all. See

270[network policy](/grok-bot/security#network-policy) for the modes and how a289[network policy](/grok-bot/security#network-policy) for the modes and how a

277Manifests of install scripts that run on every team computer, so the same296Manifests of install scripts that run on every team computer, so the same

278tooling is present everywhere. Keep secret values out of setup scripts; when a297tooling is present everywhere. Keep secret values out of setup scripts; when a

279script needs a credential, store it as a [Team Secret](#team-secrets) and read298script needs a credential, store it as a [Team Secret](#team-secrets) and read

280it from the environment. Members see the managed setup under **Team Setup** in299it from the environment. For how manifests run, and to

281the app, where they can review or reinstall it. For how manifests run, and to

282install a networking client that reaches private services, see300install a networking client that reaches private services, see

283[Connect to private networks](/grok-bot/private-networks). To run extra301[Connect to private networks](/grok-bot/private-networks). To run extra

284scripts on one cohort's computers only, add them under302scripts on one cohort's computers only, add them under

436A group control left at the team's value changes nothing, so tighten controls454A group control left at the team's value changes nothing, so tighten controls

437on the Grok Bot page and widen them per group.455on the Grok Bot page and widen them per group.

438 456 

457Network is the exception: a group's network policy replaces the team's for its

458members, whether looser or tighter, **Lock for All Groups** keeps the team

459policy for everyone, and a member of several groups gets the most restrictive

460policy.

461 

439The tab has four sections:462The tab has four sections:

440 463 

441* **Agent Capabilities.** Allow [Cloud Agents](#cloud-agents), raise the464* **Bot Capabilities.** Allow [Cloud Agents](#cloud-agents), raise the

442 [Execution on Local Computer](#execution-on-local-computer) ceiling, or turn465 [Execution on Local Computer](#execution-on-local-computer) ceiling, or turn

443 on [Allow Local Egress](#allow-local-egress) for group members when the team466 on [Allow Local Egress Routing](#allow-local-egress-routing) for group

444 has them off or stricter. For Auto-review, **Don't enforce for this group**467 members when the team has them off or stricter. For Auto-review,

468 **Don't enforce for this group**

445 lifts the team's [Enforce Auto-review](#enforce-auto-review) lock so group469 lifts the team's [Enforce Auto-review](#enforce-auto-review) lock so group

446 members can turn Auto-review off, and group Auto-review rules combine with470 members can turn Auto-review off, and group Auto-review rules combine with

447 the team's [Auto-review rules](#auto-review-rules), with **Ask first**471 the team's [Auto-review rules](#auto-review-rules), with **Ask first**

448 winning when rules conflict.472 winning when rules conflict.

449* **Network.** The group's own network policy, as described under473* **Network.** The group's own network policy, as described under

450 [Network Controls](#network-controls). A locked team policy applies to474 [Network Controls](#network-controls). A locked team policy applies to

451 everyone.475 everyone. A member of several groups gets the most restrictive one.

452* **Group Rules.** Rules for the group's Bots, combined with476* **Group Rules.** Rules for the group's Bots, combined with

453 [Team Rules](#team-rules). Members cannot turn them off.477 [Team Rules](#team-rules). Members cannot turn them off.

454* **Setup Scripts.** Manifests that run on group members' computers alongside478* **Setup Scripts.** Manifests that run on group members' computers alongside

474Enable Grok Bot and manage capabilities, Enforce Auto-review, group access,498Enable Grok Bot and manage capabilities, Enforce Auto-review, group access,

475network policy, team rules, and setup scripts through the499network policy, team rules, and setup scripts through the

476[Admin API](https://cursor.com/docs/account/teams/admin-api#grok-bot).500[Admin API](https://cursor.com/docs/account/teams/admin-api#grok-bot).

477[Team Secrets](#team-secrets) are managed from the dashboard only.501[Team Secrets](#team-secrets) are managed from the dashboard only. To recreate,

502terminate, or delete members' computers from a script, see

503[Run operations through the API](/grok-bot/computers#run-operations-through-the-api).

478 504 

479## Security505## Security

480 506 

574 600 

575* [Grok Bot security](/grok-bot/security)601* [Grok Bot security](/grok-bot/security)

576* [Grok Bot security FAQ](/grok-bot/security-faq)602* [Grok Bot security FAQ](/grok-bot/security-faq)

603* [Deploy Grok Bot to your organization](/grok-bot/deployment)

577* [Configure identity and access](/grok-bot/identity-and-access)604* [Configure identity and access](/grok-bot/identity-and-access)

578* [Connect to private networks](/grok-bot/private-networks)605* [Connect to private networks](/grok-bot/private-networks)

579* [Configure TLS-inspecting proxies](/grok-bot/proxies)606* [Configure TLS-inspecting proxies](/grok-bot/proxies)

311. Retry from the error state.311. Retry from the error state.

322. Restart Grok Bot.322. Restart Grok Bot.

333. Check for a Grok Bot app update.333. Check for a Grok Bot app update.

344. If the computer remains unreachable, open **Settings → Updates** and choose344. If the computer remains unreachable, open **Settings → Computer** and choose

35 **Update** under **Grok Bot's Computer**.35 **Update Bot's Computer**.

36 36 

37## The computer cannot be reached37## The computer cannot be reached

38 38 

452. Restart the Grok Bot app.452. Restart the Grok Bot app.

463. Choose **Recover computer** from the unreachable-computer state when offered463. Choose **Recover computer** from the unreachable-computer state when offered

47 (the confirmation dialog calls it **Recover Grok Bot's Computer**).47 (the confirmation dialog calls it **Recover Grok Bot's Computer**).

484. If recovery is not available, open **Settings → Updates** and choose484. If recovery is not available, open **Settings → Computer** and choose

49 **Update** under **Grok Bot's Computer**. On iPhone and Android, the same49 **Update Bot's Computer**. On iPhone and Android, **Settings → Bot → Bot

50 controls are **Update Computer** and **Reset Computer** under **Settings →50 Computer** has **Reset Computer**.

51 Bot → Bot Computer**.

525. Wait for the replacement computer to become available.515. Wait for the replacement computer to become available.

536. Use **Reset** only if recovery and update fail and you accept losing recent526. Use **Reset** only if recovery and update fail and you accept losing recent

54 unsynced work.53 unsynced work.

85 84 

86## A plugin will not install or authenticate85## A plugin will not install or authenticate

87 86 

881. Open **Marketplace** from the sidebar, choose **Your plugins**, and confirm871. Open **Connect apps** from the sidebar, choose **Your plugins**, and confirm

89 the plugin is listed under **Installed**.88 the plugin is listed under **Installed**.

902. Reopen its detail page and choose the authentication action.892. Reopen its detail page and choose the authentication action.

913. Complete authorization with the intended account in the browser.903. Complete authorization with the intended account in the browser.

158 157 

159## Update Grok Bot158## Update Grok Bot

160 159 

161The Grok Bot app and the Agent Computer have separate updates.160The Grok Bot app and Grok Bot's computer have separate updates.

162 161 

163* To update the app, open **Settings → Updates → Check for Updates**. If an162* To update the app, open **Settings → Updates → Check for Updates**. If an

164 update is ready, choose **Restart to Update**.163 update is ready, choose **Restart to Update**.

165* To rebuild the cloud computer, choose **Update** under **Grok Bot's164* To rebuild the cloud computer, open **Settings → Computer** and choose

166 Computer** in the same section.165 **Update Bot's Computer**.

167 166 

168Updating the desktop app does not reset the cloud computer.167Updating the desktop app does not reset the cloud computer.

169 168