One of the easiest and most helpful features of Cursor is Cloud Agents. With often 1 click you can have an agent in an ephemeral environment that you control. However, these agents often need access to external systems. There is an embedded secrets tab but that is the same-old foothold problem all over again: a long-lived Vault token sitting in an agent environment until you remember to rotate it.
Cloud agents can mint a short OIDC JWT from a local unix socket. Vault already knows how to trust that. Wire the two together so an agent can log in, read secrets from Vault and leave no static credential behind.
This write-up assumes a personal Cursor account (no Teams plan). It also assumes a network route to Vault.
TL;DR
Cursor agents can mint JWTs
