Support investigation workflow
Cursor's technical support team runs customer investigations inside Cursor itself, configured for support work: multi-root workspaces over the product repositories, MCP servers that reach customer databases, event logs, Slack, the ticket tracker, and internal runbooks, plus slash commands, Rules and Skills, and four named subagents whose merged output an engineer reviews before sending.
- Company
- Cursor
- Approach type
- Agent
- Work
- Support
- Human involvement
- Varies by scope: Continuous steering, Work-product review. See each scope.
- Invocation
- Interactive, Background
- Interfaces
- Cursor, Slack
- Deployment stage
- Deployed
- Evidence strength
- Limited primary
- Entry reviewed
How it works
Customer report through an Ask Mode investigation over code, logs, prior threads, and runbooks to a reviewed escalation, customer reply, or documentation pull request.
The investigation typically starts in Ask Mode pointed at the symptom, tracing backward through the relevant product behavior with indexed semantic search over product code, docs, and internal tooling[Source 1]
Datadog MCP pulls the relevant logs and traces into the investigation thread to narrow whether the problem is reproducible or transient and whether it failed client-side, at the API edge, in a downstream dependency, or in auth[Source 1]
Searches across the support platform and Slack start from hard identifiers such as error strings and request IDs, broaden if needed, and look for the newest thread carrying a current status, a workaround, and an owner[Source 1]
Notion MCP pulls the relevant runbook into the thread to cross-reference what the engineer is seeing, then either confirms the behavior or supports a clearer escalation[Source 1]
The Linear MCP turns the material gathered during the investigation into a formatted escalation without leaving the thread[Source 1]
When several customers hit the same question, a mention of the Cursor agent in Slack with what needs updating sends a cloud agent to open a pull request against the docs repository[Source 1]
Where people stay involved
People review, approve, or guide the agent’s work here.
Reported: A support engineer drives the investigation session, and the merged subagent output is reviewed before it is sent; documentation changes return as a pull request.
Supervision level
Continuous steering
A person pairs with the agent throughout execution.
Level 2 of 5
- customer symptom → root cause, inside a Cursor investigation session[Source 1]
Supervision level
Work-product review
A person reviews the draft or implementation.
Level 3 of 5
- parallel subagent run → merged escalation, customer reply, or docs pull request[Source 1]
Implementation details
- Model
- Not reportedThe post names Ask Mode, subagents, and cloud agents, but no model or model version anywhere.
- Harness
- Cursor's own editor and agent product configured for support investigations: multi-root workspaces over several repositories, Ask Mode investigations, MCP servers for support systems, slash commands, Rules and Skills, subagents, and a Slack-triggered cloud agent that opens documentation pull requests[Source 1]
- Sandbox
- Not reportedThe post says the codebase is available locally and a cloud agent opens docs pull requests, but describes no execution isolation boundary for either.
- Tool access
- MCP servers reach customer databases holding subscription tier and team and privacy settings, streamed event logs covering services used, telemetry errors, and network issues, Slack threads, engineering ticket platforms, an internal documentation service of runbooks and troubleshooting guides, and an account management service; the named integrations are Datadog for logs and traces, the support platform and Slack for prior cases, Notion for runbooks, and Linear for escalations[Source 1]
- Knowledge
- The full codebase is available locally, and Cursor indexes and semantically searches product code, docs, and internal tooling in the same session; runbooks and troubleshooting guides, Slack threads, and past support conversations arrive through MCP servers[Source 1]
- Context management
- One Cursor session collapses code, logs, team knowledge, and past conversations; multi-root workspaces keep related repositories together so a question spanning frontend logic, backend policy checks, and docs stays answerable in a single thread; subagent results merge into a single output[Source 1]
- Credentials
- Not reportedThe post lists the systems the MCP servers reach, including customer and account management data, but never says how the session authenticates to them or whose permissions apply.
- Interfaces
- cursor
- slack
Mechanisms
Code, logs, team knowledge, and past conversations come together in a single Cursor session, which the team describes as removing the context-gathering bottleneck for most of its work[Source 1]
MCP servers bring customer databases, streamed event logs, Slack, engineering ticket platforms, an internal runbook service, and an account management service into the investigation instead of making the engineer search each tool separately[Source 1]
Slash commands cover the most frequently repeated steps of the process, and Rules and Skills automate common processes in support investigations; the captured page does not list the individual commands, rules, or skills[Source 1]
LogInvestigator searches Datadog for the failure point and supporting evidence, KnownIssueMiner scans Slack and Notion for prior threads and workarounds, TicketWriter formats the evidence into a complete escalation, and CustomerReplyDrafter writes the customer response with internal details stripped out; the results merge into a single output[Source 1]
Validation and failure handling
Not reported: The post names review of the merged output before sending, but no correctness check, evaluation, test, or accuracy measurement for the investigation result.
Reported observations
These results come from the sources. Notes below each result explain what it covers and any reported limits.
Cursor reports that over 75% of its support interactions run through Cursor itself and that support engineer throughput increased 5-10x; the post gives no measurement period, denominator definition, or method.[Source 1]
- Reported by
- Cursor
- Scope
- Cursor support interactions and support engineer throughput, as stated in March 2026
The source does not report the denominator of this figure.
Observed in March 2026
About this result
- Category
- Adoption output
- Evidence type
- Reported measurement
- What it covers
- Share of Cursor support interactions running through Cursor itself and the reported support engineer throughput multiple, both stated in March 2026 without a period, denominator, or method
Cursor estimates the combined workflow makes its support team as much as an order of magnitude more productive than traditional approaches that require jumping between tools and across teams[Source 1]
- Reported by
- Cursor
- Scope
- Productivity of the support team against traditional approaches that require jumping between tools and across teams
- Method
- Team estimate; the post gives no method
The source does not report the denominator of this figure.
Observed in March 2026
About this result
- Category
- Effectiveness
- Evidence type
- Estimate
- What it covers
- Team estimate of support productivity against traditional multi-tool approaches, hedged with 'as much as' and reported separately from the throughput range
Lessons
Cursor's support engineers search prior cases by hard identifier first, such as an error string or request ID, broaden the search only if that fails, and take the newest thread that carries a current status, a workaround, and an owner.[Source 1]
Cursor keeps the repositories a support question spans in one multi-root workspace, so a question about frontend logic, backend policy checks, and documented expected behavior stays answerable in a single thread.[Source 1]
Cursor's support team treats several customers asking the same question as a documentation gap and files the fix itself, mentioning the Cursor agent in Slack to get a pull request opened against the docs repository.[Source 1]