Cursor Canvas Tool
Paste a Cursor .canvas.tsx file, preview it in the browser, and publish a short shareable link.
Security Considerations
The canvas source is compiled in the browser and executed as React. Treat pasted files the way you would treat any executable snippet.
What is allowed
- Only
cursor/canvasand React modules can be imported useCanvasActionlaunches local Cursor through OS protocol handlers. Confirm the prompt before allowing it. The browser cannot read your disk.- Source larger than 200,000 characters is rejected
What is public
- Shared pages store source on the WorkerJob backend
- Public links: anyone with the URL can load the source and the rendered page
- Password links: the password is stored in plaintext and copied onto the share URL as
?password=; the source is returned only after a correct password (the author session skips this) - Expired links return an error to viewers
- Treat published canvases as documents, not secrets — a password is access control, not encryption
What this tool is not
- Not the official Cursor IDE renderer
- Not a place to host production apps
- Not a substitute for reviewing untrusted code in isolation
Do not paste credentials, private tokens, or customer data into a canvas you intend to share.