Extending: MCP, skills, commands & hooks

Most of what an agent can do stays inside the repo. It reads the CSV importer, runs the test suite, edits the money math, picks up the project’s conventions from AGENTS.md. But budgetcli - the course’s illustrative personal-finance API - keeps some of its truth outside the files. The accounts and transactions it reconciles live in a running Postgres database no config in the repo describes. The euro and pound transactions need a live exchange rate the agent has never seen. And the one move you treat as sacred - never let an agent write to the real ledger - is exactly the kind of rule you can’t afford to leave to the model’s good intentions.

Cursor answers each of those with a different extension surface, and this chapter is about which surface a given problem actually calls for - the question that trips people up far more often than the syntax does. There are four surfaces for those needs (as of September 2026 each has primary documentation - commands’ home is the Customize overview pending a dedicated page: MCP, skills, commands, hooks):

• Reach - an MCP server is a bridge, speaking the open Model Context Protocol, to a system Cursor otherwise can’t touch: a database, an HTTP API, a SaaS dashboard. You declare it in mcp.json and the model gets new tools it didn’t have.
• Structure (procedure) - an Agent Skill is a folder with a SKILL.md that packages a repeatable procedure - the steps you’d otherwise re-explain every session. The agent loads it when the work matches.
• Structure (prompt template) - a custom slash command is a saved prompt you fire with /name in chat. Where a skill is a procedure the agent reasons through, a command is a canned instruction you trigger by hand.
• Gate - a Hook is a deterministic script wired to a moment in the agent’s lifecycle (command hooks are the default kind; prompt hooks also exist). It runs regardless of what the model decided, which is how you enforce a rule the agent can’t talk its way around.

The order of the chapter is the order the need shows up in real work: first widen what the agent can reach, then package the procedures and prompts you keep repeating, then put a wall around the move that must never go wrong.

The moves of this chapter

• MCP servers - declare budgetcli’s Postgres database and its exchange-rate API as servers the agent can query, and watch what each mounted one costs - MCP servers: reach past the repo
• Agent Skills - write the CSV-import recipe once as a SKILL.md the agent loads when the work matches - Agent Skills: package the procedure
• Custom slash commands - save the prompts you keep retyping as /name templates, and the no-arguments limit that decides their shape - Custom slash commands
• Hooks - wire a subprocess into the agent’s lifecycle so the one unforgivable write is refused every time, model-independent - Hooks: the gate that can say no

The arc runs from what the agent can see, to what it stops re-deriving, to what it can never do. The first lesson hands it systems it otherwise has no way to touch. The second and third stop you re-teaching the same procedure and re-typing the same prompt every session. The fourth stops trusting the model at all on the single move where trust is not good enough. Treated as one undifferentiated pile of config under .cursor/, the four blur together; the chapter’s payoff is knowing which of the four a problem needs before opening a file.