How operators run X, Cursor, MCP, and the cloud computer

Fetched and re-checked against public posts through 2026-09-04, plus a fresh X pass on 2026-09-04. Isolation is still per user. Screens are not a fence. Official packages stay on x.ai/bot.

1. Draw the map before you hire another Bot

Operators who last past week two stop treating “Grok Bot” as one blob. Simon Loewen’s field note is the clean split: Cloud Agent = the repo VM that opens a PR; Grok Bot = the signed-in computer that keeps going when the laptop closes. Staff on the Cursor forum: there is no codebase plugin. Coding work goes to a Cloud Agent already connected to GitHub.

1. Grok Bot app — roster, chat, approvals. Not a Cursor IDE panel. Relationship: Cursor and Grok Bot.
2. Shared cloud computer — browser, /workspace, terminal. One machine per user. Lesson: shared computer.
3. Plugins / remote MCP — account-level tools. Prefer a connector. No localhost. Lesson: plugins.
4. Cursor Cloud Agent — a different VM on a GitHub repo. The Bot can brief it. You merge.
5. Official X plugin — connect the profile; @bot says a developer account and included credits appear. Read and search first.

Puneet Singh’s debugging order matches official computer docs: memory in /workspace → MCP / connector → public web → signed-in browser on the box → desktop GUI. Do not open Chrome because the page is there.

Sources: Simon Loewen · Puneet Singh · Cursor forum: no codebase plugin · @bot X support.

2. Run X as research. Publish stays with you

Official @bot (2026-08-29): connect your X profile; a developer account is created automatically with included credits. Min Choi’s same-day post is the capability list operators actually use: timeline, posts, mentions, likes, Spaces, advanced search, full-archive, any public account’s recent posts, and who liked. That is a research database, not a license to fire the social team.

Peter Yang’s public “five to try” already had an X scout: watch a niche, return angles, you write. Field replies converge on the same gate ygns178 wrote out loud: read mentions, draft in your tone, post only after you approve. Greg Isenberg’s newsletter-desk thread is the same shape for long-form — agents prepare, the operator ships.

If the official X plugin shows connected with tools=0, or refresh fails, that is still documented on the plugins page. Stop. Do not open x.com login in the cloud browser to type a password. Do not paste a Bearer token. Do not treat a 29-platform scheduler post as the official write path.

You scout X. I write.

Use the official X connector if it is connected and tools appear. If connect failed or tools stay at zero, stop and tell me. Do not open x.com login. Do not ask for a Bearer token or API key.

Watch this niche and these accounts: [list]. Last 24 hours unless I say otherwise.

Return at most 8 posts. For each: url, first line, why it moved, whether I have a receipt they do not. If nothing is moving, say “quiet window.”

Never like, follow, reply, quote, bookmark, or post. Never draft a copycat.

Read my mentions from the official X connector, not the cloud browser. Draft replies in the voice samples in /workspace/voice.md. Write drafts to /workspace/x-drafts.md with the original url and a one-line risk flag.

Do not post, reply, like, or follow. Flag legal, payment, or account-security asks. If the connector has no tools, stop.

Sources: @bot · Min Choi · Peter Yang five to try · Greg Isenberg.

3. Cursor does the repo. The Bot writes the brief

n2parko’s SpaceXAI product shots showed a roster handing off PRs. _duyet runs one Bot per repo and talks to a leader that delegates. M3NT8L’s field note: when you connect GitHub in Grok Bot and ask for coding work, the Bot delegates to a Cursor Cloud Agent (whatever model Cursor offers). iam4x wires Sentry → Cloud Agent → PR for review. Michael Fenech’s CoS brief is the operator sentence: investigate, spin a Cloud Agent, open a PR. Timed “three minutes later” claims stay in the original.

The handoff is still a file. CitiZenSleuthX asked for shared threads between Grok Bot and Cloud Agent runs started in the Cursor app — there isn’t one. People copy a /workspace brief. Compound Engineering and similar packs install once in the Cursor marketplace; Grok Bot inherits that library. Do not clone those repos onto the Bot computer. Community CLI grok-bot-skill is the other direction: a coding agent calling a Bot, not the official app.

Launch can fail. A dated Cursor forum thread: Grok Bot returns “GitHub is rate limiting requests” while the user’s own GitHub quota is fine. Two grants also confuse people — Cursor’s GitHub app (Cloud Agent) is not the Bot-side GitHub / remote MCP plugin. If launch fails, paste the full error. Do not retry in a loop. You merge.

Write /workspace/cloud-agent-brief.md for a Cursor Cloud Agent.

Include: repo, branch, failing test or issue url, what “done” looks like, files you must not touch, and that I merge the PR.

Do not start the Cloud Agent until I say go. If launch returns a GitHub rate-limit line or “reconnect GitHub,” stop and paste the full error. Do not retry in a loop.

The Bot computer is not the repo VM. Do not clone the repo onto this box. Do not paste a GitHub PAT into chat.

Sources: n2parko · _duyet · M3NT8L · iam4x · CitiZenSleuthX · forum: launch rate-limit.

4. MCP is remote. Money and sends still need you

Official computer docs: prefer a connector when one exists. Staff: Grok Bot cannot attach local or stdio MCP. Ask the Bot in chat to add a public HTTPS streamable HTTP/SSE server. An MCP that only listens on localhost on your laptop is unreachable from the cloud box.

Wayne Sutton shipped a site from the phone on Convex and Cloudflare plugins, not a cloud-browser shopping spree. Gergely Orosz connected support mail and Stripe and still required a human before money moved. Box wrote back through MCP after a reconcile. Gojiberry’s sales pack is a hosted MCP — do not invent contacts. The GitHub remote MCP plugin is a different grant from Cursor’s GitHub app; treat them as two doors.

Add this remote MCP: [https URL]. Confirm it is public HTTPS (streamable HTTP or SSE), not localhost and not stdio on my laptop.

After it appears, list the new tools in /workspace/tools.md. Do not send, pay, delete, or write until I approve.

If add fails, stop. Do not install a VPN client on this computer. Do not paste API keys into chat — use the secrets card.

Sources: official skills / computer docs · Wayne Sutton · Gergely Orosz · Connect plugins.

5. The computer is the factory floor

Lee Robinson’s public notes: thin client, always-on box, browser as a tool. That is design, not a second fence. Every connector you install is account-level — the X session, GitHub, Stripe, and mail are visible to the whole roster. Keep standing rules and source-of-truth files in /workspace. Logos52 dumps what a fleet writes there; jblack4vols keeps dated logs. That is how the next run reads a file instead of last Tuesday’s chat — same rule as after week one.

Execution on Local Computer is a different surface: only when you turn it on and approve. Default is ask every time. The cloud box cannot join an enterprise VPN; a bad VPN client can take the machine offline. Internal sites: local execution on a machine already on VPN, or Tailscale / Cloudflare Tunnel per Team Setup docs.

Sources: Lee Robinson · Bots are not a security boundary · shared computer.