Cursor, without the per-seat bill
Cursor speaks the Anthropic Messages API when you pick a Claude model. The LMbox Box intercepts those calls, routes to whichever tier is enough (local or Bedrock EU), and exposes internal connectors via MCP. You keep Cursor; you stop paying $20/dev/month on top of the Anthropic API.
Cursor at team scale: double bill, code leaks to Anthropic
$20/dev/month for Cursor
Cursor Pro is $20/seat/month, $40 for Business. A 30-developer team is $7,200/year before the first API call.
+ the API bill on top
The Cursor seat only covers a fast-mode quota. Beyond that, and especially for Claude Sonnet, your card is charged on every chat. No clear ceiling for the IT team.
Your repos go to Anthropic
Cursor ships open-file context + selections + @-searches to the chosen model's API. For a confidential repo, that's a deal-breaker without a network gate in front.
How Cursor plugs into the Box
Cursor accepts an Anthropic-compatible endpoint and a custom MCP server. The Box covers both. Pick what matches your sovereignty bar.
Pure local proxy
Cursor points at the Box for Claude models. Zero internet egress. Great for short sessions and inline completion via Mistral / Codestral; limited on 20+ turn agentic chats.
Cursor → Settings → Models → Override OpenAI/Anthropic Base URL → https://lmbox.local. The Box answers /v1/messages with Mistral Large 2.
Cascade routing (recommended)
The lmbox router scores each request (turns, tokens, keywords, tools) and picks fast / medium / frontier. Cursor only sees one URL; the router records its scoring in the audit log. ~75% of traffic stays local.
Same as Pattern B for Claude Code. The lmbox-router is protocol-agnostic, regardless of whether the client is Claude Code or Cursor.
MCP @ over internal connectors
Cursor supports MCP natively. Drop lmbox-mcp into .cursor/mcp.json and the 4 tools (search / read_doc / list_sources / find_similar) appear. Type @LMbox in a session to query SharePoint, Confluence, Jira — content never leaves the Box.
Streamable HTTP transport. Master-key auth in v1 (OIDC on the roadmap). Only the ranked top-K hits the model; raw doc bodies never leave the appliance.
30-developer team, three scenarios
Assumptions: 30 developers on Cursor Pro ($20/seat), heavy agentic use, observed cascade ratio 65/25/10 (fast/medium/frontier). Bedrock EU pricing as of May 6, 2026, € ≈ $1.08.
| Scenario | Cursor seats | Anthropic API | LMbox cost | Monthly total |
|---|---|---|---|---|
| Cursor Pro direct (no LMbox) | ≈ €555 | ≈ €6,000 | — | ≈ €6,555 · €78,660/year |
| LMbox cascade (75% local) | ≈ €555 | ≈ €1,200 | Box amortised over 36 months | ≈ €1,850 · €22,200/year |
| 100% local (Mistral) — Cursor frontier disabled | ≈ €555 | €0 | Box amortised over 36 months | ≈ €600 · €7,200/year |
The Cursor seat still buys you the IDE features (inline autocomplete, agent-mode, multi-cursor edit). What gets cut is the API bill on top, not the editor subscription itself.
Point Cursor at the Box
1. Override the Anthropic base URL
In Cursor → Settings → Models → Override Anthropic API. The key can be any non-empty value — the Box authenticates internally on X-LMbox-* headers.
Anthropic Base URL: https://lmbox.local Anthropic API Key: $(lmbox vault get cursor_passthrough_key)
2. Pick a Claude model in Cursor
Choose 'claude-sonnet-4.5' in Cursor. The Box rewrites the model name based on the tier the router picked (Mistral / Qwen / Sonnet).
$ lmbox router test "Cross-file refactor of the billing module"
{ "tier": "frontier", "score": 18, "would_route_to": "bedrock/anthropic.claude-sonnet-4-5-20250929-v1:0" }
3. Audit costs at week's end
After a week the audit log shows who routed where — useful to recalibrate the scoring if the team feels a local model gets too many hard requests.
$ lmbox router stats 7 TIER REQ ERR TIN/M TOUT/M P50ms P95ms COST€ fast 4,230 1 2.84 0.51 78 142 0.00 medium 1,102 0 5.71 1.42 1,430 2,810 0.00 frontier 303 2 4.21 1.32 340 980 58.74 TOTAL 5,635 58.74
Plug Cursor into the LMbox connectors
Pattern C — Cursor has supported MCP natively since 0.49. Three steps to expose SharePoint / Confluence / Jira / GitLab as @LMbox inside the Cursor chat.
1. Declare the MCP server in Cursor
Create .cursor/mcp.json at the project root (per-project) or ~/.cursor/mcp.json (global). The key comes from the age-encrypted vault.
{
"mcpServers": {
"LMbox": {
"url": "https://lmbox.local/mcp",
"headers": {
"x-lmbox-mcp-key": "${LMBOX_MCP_KEY}"
}
}
}
}
2. Verify the tools on the Box side
The server exposes 4 tools. Cursor picks them up after a window reload.
$ lmbox mcp tools • search args=(query, source, top_k) • read_doc args=(doc_id, source) • list_sources args=() • find_similar args=(text, source, top_k)
3. Use @LMbox inside Cursor's chat
Type @LMbox followed by a query. Cursor calls the search tool; the query runs in the Box; only the top-K reaches the model.
> @LMbox find anything in Confluence about our Azure AD SSO flow [tool] LMbox.search confluence "Azure AD SSO flow" → 8 hits [model] The SSO flow is documented across 3 pages…
Cursor + MCP: zero exfiltration on the editor side
Cursor calls MCP tools client-side itself — the request goes from your machine to the Box, never through Anthropic. Combined with the LLM proxy, that means no byte of Confluence or SharePoint touches Cursor or Anthropic servers.
Questions teams raise before signing
+ Does Cursor still send data home?
+ Which Cursor models can be routed?
+ How do I cut off the Anthropic passthrough during an incident?
+ Does Cursor accept a non-Anthropic base URL?
+ Since when does Cursor support MCP?
We install the Box, we connect Cursor
30-day on-site POC with a team of 10 to 30 developers. We measure the actual local/frontier ratio + disable Cursor's cloud telemetry where we can. If the team complains, we pack up.