Cursor 3.9 Customize Page: What the Unified Plugin, MCP, and Subagent Governance Layer Means for Operator Teams

The governance question that enterprise AI teams have been asking about Cursor just got a cleaner answer. With version 3.9 (released June 22, 2026), Cursor collapses plugins, skills, MCPs, subagents, rules, commands, and hooks into a single Customize page — and gives operators per-scope controls at the user, team, and workspace level. For teams routing through a shared AI gateway, this changes how you audit which tools your coding agents can call, which MCP servers they can reach, and which subagent behaviors are permitted.

What changed in Cursor 3.9

The headline feature is a new Customize page that brings together everything that previously lived in scattered menus. From a single view, a developer or admin can add and manage:

• Plugins — third-party capability packages
• Skills — reusable agent behaviors
• MCPs — Model Context Protocol servers that expose external tools and data sources
• Subagents — named child agents with specific roles
• Rules, commands, and hooks — workflow configuration

Each of these can be scoped at three levels: user (individual developer), team, or workspace. An operator can configure what's available to the entire team from a central policy, and developers can extend within what the team policy permits.

The Marketplace leaderboard shows the most popular plugins, skills, and MCPs across the team. Any item can be added to a developer's setup with one click from the Customize page, pulling from the team's curated library.

Plugin canvases add a new abstraction: prebuilt shared templates that teammates can open and reuse. The examples given are a Hex Canvas for data visualizations and an Atlassian Canvas for real-time issue/project views.

Team marketplaces gain import support for plugin repositories hosted on GitLab, Bitbucket, and Azure DevOps — previously only GitHub-hosted repositories were supported. This matters for enterprise environments where internal tooling lives on self-hosted version control.

Why it matters for AI engineering teams

The immediate governance implication is that MCP policy is now a first-class administrative concept in Cursor — not just a developer preference. Before 3.9, an MCP server configured by one developer had no enforced boundary relative to team policy. With per-scope controls, a team admin can define which MCP servers are approved, and the Customize page surfaces what each developer is actually running.

For teams that route agent requests through a centralized gateway, this creates a new auditable signal: which tools did a given session have access to? When a cloud agent fires off a webhook trigger (via Automations, introduced in Cursor 3.8) and makes downstream API calls, the MCP configuration at the team scope determines what external services that agent could reach. That tool surface is now inspectable from a single page rather than reconstructed from per-developer config files.

The GitLab, Bitbucket, and Azure DevOps marketplace import support closes an enterprise gap that previously forced teams on non-GitHub version control to maintain workarounds. Internal plugin repositories can now be distributed through the same team marketplace workflow as public ones.

Subagent governance also tightens in 3.9: subagents are managed alongside plugins and MCPs in the same Customize page, so the policy for which subagent profiles exist, and at what scope, is no longer separate from other tool configuration.

The router/operator angle

For operators who manage Cursor-based teams through a centralized AI routing gateway, three things are worth updating:

MCP server inventory. The Customize page gives you a team-level view of which MCP servers are enabled. Cross-reference this with the tool calls flowing through your gateway to identify gaps — MCP servers that are approved in Cursor policy but whose traffic is not yet accounted for in your routing or billing layer.

Subagent model routing. With subagent scopes managed in Customize, teams can define named subagent profiles at the workspace level. If those profiles reference specific model endpoints, your gateway needs to handle routing for those identities — especially relevant when a subagent's model should be isolated from the parent agent's budget.

Plugin canvas auditability. Plugin canvases (the Hex and Atlassian examples) are workspace-level shared state that can read external data sources. For regulated teams, understanding what data a canvas can pull — and whether that pull goes through your proxy — is a new audit surface.

What TheRouter users should watch or try

If your team uses Cursor's Automations (3.8) and now Customize (3.9), the governance layer inside Cursor is maturing into something that resembles what a gateway operator would want: scoped policy, team-level curation, and an auditable list of approved tools.

The practical question for teams routing through an AI gateway: does your gateway's tool-use logging capture MCP-initiated calls that originate from Cursor subagents? If not, Cursor 3.9's expanded scope definitions mean the tool surface your agents operate with just grew — and that growth should be visible in your routing and cost model.

Check your gateway's MCP logging configuration and verify that workspace-scoped MCP servers added via Cursor 3.9's new Customize page are included in your provider routing policy.