Cursor Live Apps: build, host and share apps from a prompt

Short answer: Cursor announced Build Live Apps on November 5, 2026. You describe a tool to a Cursor cloud agent, and Cursor builds the web app, sets up a Postgres database if it needs one, puts it behind Cursor sign-in, hosts it and gives you a live link once its security checks pass. It is available on all paid Cursor plans that include cloud agents, and it puts Cursor in direct competition with prompt-to-app builders such as Lovable, Replit, Bolt and v0.

Until now, Cursor was where you wrote and changed code; getting that code onto a URL other people could open was your job. Build Live Apps moves hosting, database, sign-in and secrets inside Cursor. Below we cover what Cursor announced, how it works, who it is for, the guardrails, how it compares with Lovable, Replit, Bolt and v0, and what it means if you are choosing an AI app builder. We worked from Cursor's changelog and Apps documentation and each rival's own publishing docs, and we say where a detail comes from news coverage instead.

What Cursor announced

In its November 5, 2026 changelog post, Cursor said that agents have lowered the cost of writing code, "but most apps and tools that users build never make it off of localhost." The fix: build live apps directly in Cursor and share them with a link. You describe what you want, and Cursor builds the app, sets up a database, configures auth and deploys it. Cursor announced the launch on X the same day.

Cursor's own examples are mostly internal business tools: ops tools for event registration, account assignments and desk seating; customer presentations that mix slides, video and interactive demos; onboarding and training experiences; live pipeline dashboards for sales teams; and portals for engineering services. The pitch is that anyone in an organisation, not only engineers, can build a useful tool and share it with teammates.

Vercel said on X that the feature is built on its Vercel for Platforms infrastructure. Cursor's own announcement does not name a hosting provider.

How Build Live Apps works

According to Cursor's Apps documentation, the flow looks like this:

• Start a cloud agent and say you want an app. Cursor says to be explicit that you want it to build an app. The feature only works with cloud agents, not with agents running locally on your machine.
• New or existing code. Starting from scratch creates a new repository on Cursor Origin, Cursor's own code-hosting service. You can also ask Cursor to deploy an app from an existing GitHub repository. Cursor says support for other git providers such as GitLab is coming.
• Backend handled for you. If the app needs a database, Cursor provisions Postgres automatically. Private and team apps sit behind Cursor sign-in. If the app needs to reach your own systems, such as a data warehouse, Cursor asks for the secrets it needs, and the docs say the agent never sees their values.
• Preview, then publish. When the app is ready, Cursor shows a tray where you can preview and publish it. You pick the app's URL (you can change it later), Cursor runs its security checks and, if they pass, returns a live link. If they fail, it lists what needs fixing. Nothing goes live until you choose to publish.
• Isolated hosting. Cursor deploys each app in a dedicated hosting account it creates for your team, or for you on an individual plan, isolated from every other customer.

The docs include sample prompts such as building a weekly signups dashboard with a filterable chart and table, an internal bug-report tracker, a launch microsite with an email sign-up form, or simply "Deploy this repo as an app."

Sharing, access and API keys

Apps have three visibility levels in Cursor's docs: people you invite (specific signed-in team members or groups), your whole Cursor team, or public (anyone with the link). Public sharing is available on individual plans; on Teams and Enterprise it is off by default and a team admin can turn it on in the Apps dashboard.

Because private and team apps sit behind Cursor sign-in, scripts and bots can't simply load them. Cursor's answer is API keys: a personal key opens the apps its owner can open, a team key opens only the team apps it has been given, and requests made with a key are marked as automated. Admins can allow or block API-key access to apps.

Security checks and admin controls

This is where Cursor is most specific. Its docs list four checks that run before every publish, even when the AI security review is turned off:

• block secrets written in app files, such as API keys or access tokens;
• block credential files, such as private keys or service-account keys;
• never publish .env files;
• never publish source maps, so visitors can't read the original source.

On top of those, an AI security review reads the app's files and blocks serious issues before the app goes live. Team admins can add their own rules to that review (they can't remove Cursor's built-in checks), see every app and secret on the team, unpublish any app, turn Apps on or off, and approve publishes the review blocked, except for malicious code, hardcoded secrets or exposed credentials. Setting changes go into the team's audit log.

A fair caveat: automated checks catch common mistakes like leaked keys, but no vendor says they catch everything. If an app will touch customer data or internal systems, have someone review its access rules and permissions before you share it widely. The New Stack's coverage of the launch raises the same open question about database permissions and application-level access controls.

Who it's for and how to get it

Cursor's docs say Apps is available on all paid plans with access to cloud agents. Cloud agents are not included on every Cursor plan, so check Cursor's live pricing page to see which tiers include them. Cursor's announcement doesn't publish a separate price for app hosting or databases; check the live pricing page and your usage dashboard before you rely on it for something busy.

In practice, the feature fits three groups best:

• Teams already on Cursor that want quick internal tools (dashboards, trackers, portals) without asking engineering to set up hosting, a database and sign-in each time.
• Developers with a half-finished app in a GitHub repo that never got deployed. "Deploy this repo as an app" is aimed squarely at them.
• Admins who need control. Team-level visibility defaults, admin review rules, audit logs and the ability to unpublish anything are the parts that make this easier to allow inside a company than a personal hosting account.

It is a weaker fit if you want a public, customer-facing product with your own branding, payments and growth tooling on day one. Cursor's examples and controls lean towards internal tools shared behind Cursor sign-in, and its docs don't describe custom domains for apps.

How it compares with Lovable, Replit, Bolt and v0

Prompt-to-live-app is not new; what's new is Cursor, a professional coding tool, handling hosting, database and sign-in end to end. Here is how the main alternatives handle the same "make it live" step, based on each vendor's docs:

• Lovable hosts published apps and includes a built-in backend with database, authentication, storage and functions on Supabase's open-source foundation, per its backend docs. Its publish docs describe a Quick scan that checks database access rules, dependencies and MCP server exposure, but say findings don't block publishing by default. Private, workspace-only access is a Business and Enterprise feature; Free and Pro can restrict access to invited people.
• Replit calls this step Publishing and offers several deployment types, including autoscale, static, reserved VM and scheduled, per its publishing docs. Each customer gets a dedicated, single-tenant Google Cloud project for published apps. It gives you more say over how an app runs than Cursor's one-path flow.
• Bolt has built-in hosting with a free .bolt.host address for all users; custom domains are a Pro feature, and each plan has hosting usage limits, per its hosting docs.
• v0 deploys to Vercel, with preview deployments for working branches and a stable production URL, per its deployment docs. It is the closest match if your team already runs on Vercel and GitHub.

The main difference is where you start. Lovable, Bolt and v0 begin in a chat built for creating apps; Replit begins in a browser workspace. Cursor begins in a full code editor and agent platform that many engineering teams already pay for. Cursor also stands out for having publishing blocked by default until mandatory checks pass, and for app access tied to Cursor sign-in. For side-by-side detail, see our Lovable vs Replit, Bolt vs Lovable, Lovable vs v0 and Replit Agent vs Cursor comparisons.

What it means if you're choosing tools

If your team already uses Cursor, Build Live Apps removes one of the main reasons to pay for a separate prompt-to-app builder just for internal tools. A sales dashboard or ops tracker can now go from prompt to a link your colleagues open, with sign-in, a database and admin oversight, without a second vendor or a hosting account.

If you aren't a Cursor user, this launch alone isn't a reason to switch. Lovable, Bolt and v0 are still friendlier for non-developers who want a polished public site or product, and Replit gives you more control over how a published app runs. Cursor's edge is for people who also want to open the code, keep developing it with an agent and keep it in a real repository.

For anyone evaluating AI app builders, the question is shifting from "can it write the app?" to "who hosts it, who can see it, and what stops a leaked key going live?" Compare those three things, along with plan gates and usage, before you commit. Our best Cursor alternatives guide is a good next step if you are weighing the wider field.

FAQ

What is Cursor Build Live Apps?

It is a Cursor feature, announced on November 5, 2026, that lets a cloud agent build a web app from your description, provision a Postgres database if needed, add Cursor sign-in, host the app and return a shareable live link after security checks pass.

Which Cursor plans include live apps?

Cursor's docs say Apps is available on all paid plans with access to cloud agents. Not every plan includes cloud agents, so check Cursor's live pricing page for the current tiers.

Can I make a Cursor app public?

Yes on individual plans: you can share an app with anyone who has the link. On Teams and Enterprise, public sharing is off by default and a team admin can turn it on. Otherwise apps can be shared with specific people, groups or the whole team behind Cursor sign-in.

Does it work with my existing GitHub repo?

Yes. Cursor says it can deploy apps from new or existing repositories on Cursor Origin and GitHub, and the docs give "Deploy this repo as an app" as a sample prompt. Cursor says support for other git providers like GitLab is coming soon. It only works with cloud agents, not local agents.

Is Cursor now a Lovable or Replit alternative?

For internal tools and teams already on Cursor, largely yes: it now covers hosting, database, sign-in and sharing in one place. Lovable, Bolt and v0 remain simpler for non-developers building public sites, and Replit offers more deployment types. Compare access controls, security checks and plan limits for your use case.