Extending: MCP, skills, commands & hooks

Everything Cursor has done to budgetcli so far has stayed inside the repo. It read the CSV importer, ran the test suite, edited the money math, learned the project’s conventions from AGENTS.md. But budgetcli keeps some of its truth outside the files. The accounts and transactions it reconciles live in a running Postgres database, not in any config the agent can open. The euro and pound transactions need a live exchange rate the agent has never seen. And the one move you treat as sacred - never let an agent write to the real ledger - is exactly the kind of rule you can’t afford to leave to the model’s good intentions.

Cursor solves each of those with a different extension surface, and this chapter is about which surface a given problem actually calls for - the question that trips people up far more often than the syntax does. There are four, and it’s worth pinning them apart before we touch any one of them:

• Reach - an MCP server is a bridge to a system Cursor otherwise can’t touch: a database, an HTTP API, a SaaS dashboard. You declare it in mcp.json and the model gets new tools it didn’t have.
• Structure (procedure) - an Agent Skill is a folder with a SKILL.md that packages a repeatable procedure - the steps you’d otherwise re-explain every session. The agent loads it when the work matches.
• Structure (prompt template) - a custom slash command is a saved prompt you fire with /name in chat. Where a skill is a procedure the agent reasons through, a command is a canned instruction you trigger by hand.
• Gate - a Hook is a deterministic subprocess wired to a moment in the agent’s lifecycle. It runs regardless of what the model decided, which is how you enforce a rule the agent can’t talk its way around.

The order of this chapter is the order the need shows up in real work: first widen what the agent can reach, then package the procedures and prompts you keep repeating, then put a wall around the move that must never go wrong.

The four moves of this chapter

• MCP servers - declare budgetcli’s Postgres database and its exchange-rate API as servers the agent can query, and watch what each mounted one costs you - MCP servers: reach past the repo
• Agent Skills - write the CSV-import recipe once as a SKILL.md the agent loads when the work matches - Agent Skills: package the procedure
• Custom slash commands - save the prompts you keep retyping as /name templates, and learn the limit that decides their shape - Custom slash commands
• Hooks - wire a subprocess into the agent’s lifecycle so the one unforgivable write is refused every time, model-independent - Hooks: the gate that can say no

The arc runs from what the agent can see, to what it stops re-deriving, to what it can never do. The first lesson hands it systems it otherwise has no way to touch. The second and third stop you re-teaching the same procedure and re-typing the same prompt every session. The fourth stops trusting the model at all on the single move where trust is not good enough. The person who has merely installed Cursor treats all four as one undifferentiated pile of config under .cursor/ and reaches for whichever they set up most recently. By the end of this chapter you will be the other kind of user - the one who knows which of the four a problem needs before opening a file.