SpaceXAI / SpaceXSI source-first coverage reconciliation
Opened 2026-11-05 UTC before selecting new controls, against base 99eaa3d1a38ce28ed421ac4020e37e898ea98c9e. The requested family name is SpaceXAI; current first-party naming is SpaceXSI, verified independently of existing guide headings. Historical platform slugs and existing guide URLs remain stable.
No tenants declared — Tier 0+1 only; VERIFIED-LIVE = 0. No product sign-in, settings changes, credential creation or integration enablement is authorized. Documentation evidence and offline execution do not promote maturity.
Baseline
| Guide | Version/date | Leveled controls | Pack includes | Pack source files |
|---|---|---|---|---|
| Cursor / Common Controls | 0.5.2 / 2026-10-10 | 28 | 23 | 23 (6 API, 17 config) |
| Grok Bot | 0.1.1 / 2026-10-10 | 20 | 17 | 30 (16 API, 1 Terraform, 13 Sigma), plus shared API helper |
Discovery notes (inventory opened before control selection)
https://x.ai/fetched with web retrieval on 2026-11-05. Product navigation independently lists Chat, Build, Imagine, Voice, Bot and Grokipedia; Business/Government and API entrypoints are separate management/deployment leads. Footer names SpaceX Super Intelligence LLC and SpaceXSI. This is naming/product-discovery evidence, not a configuration source.https://x.ai/legal/terms-of-servicefetched with web retrieval on 2026-11-05. Consumer terms updated 2026-10-27 name SpaceX Super Intelligence LLC (SpaceXSI), distinguish consumer services from Enterprise API/PromptIDE terms and identify employer-linked Enterprise accounts. Legal evidence only; not a hardening source.https://cursor.com/blog/joining-spacexfetched with web retrieval on 2026-11-05. Cursor’s 2026-08-14 announcement explicitly says acquisition by SpaceX completed. Historical SpaceXAI wording does not prove the current brand.https://docs.x.ai/llms.txtfetched with web retrieval on 2026-11-05. Current index lists developer/API capability families, model/tool/data lifecycle references and app documentation. Each relevant body must be read independently.- Direct shell retrieval of
docs.x.ai/llms.txtfailed DNS under the sandbox; escalated shell retrieval timed out after 30 seconds. Successful web retrieval is recorded separately. Markdown representations return an unsupported-content-type error through web retrieval; canonical HTML bodies work. Inaccessible guessed paths were replaced by links from the fetched indexes, never treated as evidence of absence.
Candidate ledger
The following census preceded control selection. All canonical HTML URLs below were fetched successfully in this session on 2026-11-05 unless explicitly marked unverified. The independent indexes were docs.x.ai/llms.txt (API, Grok, Build, Bot) and cursor.com/llms.txt (editor, Cloud Agents, Origin, SDKs, native enterprise policy). Repeated navigation copies were discarded when reading bodies.
Product and ownership map
SpaceX → SpaceXSI family (historical slug spacexai) → product-specific management planes. The SpaceX acquisition of Cursor is explicitly completed in Cursor’s August 14 announcement. Current x.ai homepage, October 27 consumer terms and October 29 Cursor security notice use SpaceXSI. The legal entity is SpaceX Super Intelligence LLC. These establish present naming, not a dated corporate rebrand announcement; no date for a SpaceXAI→SpaceXSI rename is asserted. Cursor retains its brand and Anysphere contract.
| Discovery candidate | Placement / disposition | Evidence and boundary |
|---|---|---|
| Cursor editor, Agent, CLI, MCP/plugins/hooks, enterprise policy | Existing /guides/cursor/; preserve controls and anchors |
Current hardening index; Cursor team policies do not configure console.x.ai tenants |
| Grok Bot desktop/mobile/cloud computer, shared Bots, Slack, X/email entrypoints, routines | Existing /guides/grok-bot/ |
Bot index, shared Bots, routines; Cursor-account and Grok-seat entry routes are stated separately |
| Grok web/mobile Chat, Business/Enterprise, consumer Imagine/Voice | New /guides/grok/ |
Workspace, FAQ; capabilities share account/workspace controls, not separate inferred admin consoles |
| Developer API, PromptIDE/playground, Imagine image/video, Voice/SIP/custom voices, Files/Collections, tools | New /guides/grok-api/ |
Developer index; same inference/management team plane, product-specific data/client authority covered there |
| Grok Build coding CLI and web/mobile Build boundary | New /guides/grok-build/ |
Separate source reconciliation; web publishing controls remain unverified where not documented |
| Cloud Agents, saved Builds/Apps, self-hosted workers, Automations, Bugbot, Security Agents, Approval Agents, Rollouts, Agent SDK deployments | New /guides/cursor-cloud-agents/ |
Cloud security, Automations, Agent SDK; features share execution/identity controls; individual trigger/approval/telemetry risks retained |
| Cursor Origin repositories, rulesets, apps, CLI, mirrors, CI and webhooks | New /guides/cursor-origin/ |
Settings, CLI, REST; early beta, distinct grants and signing tokens |
| Grokipedia | Explicit configuration-source gap, consumer account/data boundary only | Consumer terms name service; no fetched native enterprise-admin configuration reference; do not fabricate a hardening guide |
| Government / negotiated deployments, partner-hosted Vertex/Foundry | Explicit deployment-specific gap / external plane | Government announcement establishes the suite and custom/restricted deployments, not their admin configuration. API index identifies partner surfaces; default endpoints do not prove government identity, region or retention. Obtain deployment evidence |
| X subscription / Grok in X | Account/subscription and AI-data boundary in Grok 2.2 | Current FAQ distinguishes X operations; X privacy help supplies independent AI-data choices |
| X Chat AI entrypoints | Bot 5.4 for Bot linkage; Grok 2.2 for AI group exposure; standalone chat administration uncovered | Current personal-only Bot connection; full X Chat security/admin coverage is not inferred from Bot or Cursor policy |
| X social/account/developer platform | Retained external operational scope; not comprehensively assessed, no X/Twitter guide in this base catalog | Grok FAQ says SpaceXSI lacks operational oversight of X. Native X API authentication has separate app/user authority. Bot plugin help warns of developer-account creation. Independent X hardening remains an explicit coverage gap |
| Grok Studio | Deprecated, not a new guide | Current FAQ says unsupported; directs users to Build |
| Graphite | Unverified close/current separate-product boundary | The fetched Cursor announcement says definitive agreement. The Graphite announcement returned 404 on direct fetch; its indexed first-party text also describes a pending close. Neither establishes completed ownership; no separate Graphite guide is claimed |
Candidate reconciliation
| Candidate and source section | Plane; prerequisites/default/lifecycle | Disposition / target |
|---|---|---|
| Bot identity, teams | Cursor team / console.x.ai seat / IdP; Enterprise group gates vs Teams on by default | Existing Bot 1.1–1.3; retain edition limitations |
| Apps/computer, Vault | Account-wide apps, browser cookies, CLI credentials, files and saved payment authority; separate screens are not isolation | Bot 2.5; saved cards cannot require per-use approval; shared Secrets separate |
| Bot network security | Hosted-computer allowlist; Enterprise Apply to MCP servers OFF by default extends to backend connectors; command MCP separate | Existing 3.1 + new 3.4; Admin REST fields do not expose this new GUI switch |
| Team setup | Team Secrets/setup scripts; one-team condition; sudo ON default; existing computer restart | Existing 3.3 + new 3.5; new sudo automation unverified |
| Inference hooks | Enterprise beta; signed pre-model frames, shadow/default/fail policy/sampling/circuit/reset; full transcripts third-party | Bot 4.4 configuration and audit-event guidance; no new Sigma rule or documented REST config route. Not action prevention/output filtering or a global Cursor hook |
| Shared Bots | Manager/Collaborator/owner scope; DM requester vs channel shared computer; owner secrets; requester personal app consent; requester-only approvals | Existing Bot 5.2 corrected; distinguish Slack app installation, account linking and connected personal Slack app |
| Routines | Bot/account trigger identity; Slack reaction/any-message/etc.; webhook bearer; runs persist; thread follow-up and handoffs | Bot 5.3; pause separate from connector removal; avoid testing real actions here |
| X tags, files/results | Personal main Bot public entry; result exports; Bot-to-Bot authority returns data to originating Slack thread | Bot 5.4 plus lifecycle 7.2; entrypoint removal does not revoke cookies/secrets |
| Computers, shared deletion | Terminate retains durable disk; recreate retains sign-ins; separate permanent data deletion; Bot deletion removes teammates chats/routines | Existing Bot 7.1–7.3; containment explicitly multi-plane |
| Grok organization | Enterprise org SSO/domain association/SCIM role order+Member fallback; preview before activate | Grok 1.1–1.2; APIs for org provisioning not inferred from API-key management |
| Licenses, workspace | Team RW vs Billing RW; invitation entitlement; personal workspace and licensed-team sharing; Enterprise sales controls | Grok 1.3, 2.1; license alone not personal-workspace data protection |
| Connector management, SharePoint, MCP tunnel | Team catalog gate vs per-user OAuth vs indexing principal; separate write consent; public tunnel is reachability only | Grok 3.1–3.3; Google/Microsoft/Salesforce permissions remain provider-specific |
| Grok privacy, FAQ | Consumer data controls, assets, sign-in links, API access survives/removal differences; account deletion affects API | Grok 2.2, 4.1; negotiated business retention not assumed consumer or ZDR API |
| Management API, Auth reference | Management key distinct from inference; ACL/model/endpoint/key expiry/disable/rotation; admin list all vs member own | API 1.1–1.2; full pagination and explicit admin precondition for key audit |
| Security FAQ, regions, mTLS | Default30d vs ZDR destructive prerequisites; headers verify; US text only/exclusions; support-enabled mTLS | API 2.1–2.3; no inferred blanket residency or self-service mTLS |
| Public URLs, managing files, Collections | Private storage vs bearer public URL; omitted expiry can be permanent; revoke/deletion distinct; persistent indexed data | API 3.1–3.2; no invented per-document end-user ACL |
| Remote MCP, function/server-side tools index | Tool allowlists/authentication/app-mediated actions; empty allowed-tools means all; require_approval/connector_id unsupported | API 4.1; Bot Auto-review and Cursor MCP policy do not apply |
| Voice tokens, custom voices | Short-lived browser auth; server root key; consent/voice management, telephony inbound trust | API 4.2; SIP-specific config source gap retained until verified |
| Custom moderation, watermarks | Per-request enhanced decline and unsupported combinations; model/team watermark starts Nov7 (future as of research) | API 4.3; no claim watermark active today or DLP enforcement |
| Audit | Team management/audit pagination; stable hashed safety identifier; member removal retains API keys | API 5.1; separate lifecycle key disable/rotation, audit metadata vs content |
| Cursor hardening, extensions | Supported patches, tenancy restriction, extension cooldown0 default/signatures | Cursor 8.2, 11.4; source-linked omission reconciliation of old controls |
| Extension incident | Oct29 malicious Windows/macOS packages, host remediation separate from uninstall | Cursor 8.2 rationale and response limit; vendor primary disclosure |
| Cloud secret/network, identity, self-hosted | Unattended commands, locked egress vs defaults, redaction not credential isolation, OIDC issuer/audience/subject/runtime and own worker firewall | Cloud 1–3; provider plane configuration remains external |
| Cloud Automations, Security, Approval, Rollouts, Agent SDK | Creator/service account, Share/trigger scope, approval decisions, production telemetry; inherited VM/data controls | Cloud 4; no inference that a review agent is a human approval or Rollouts rolls back automatically |
| Cloud privacy, retention, API | Default indefinite conversations; snapshots30d rolling; deletion API not snapshot deletion; EnterpriseCMEK/earlyaccess90d | Cloud 5; no live deletion tests |
| Origin settings, CLI, REST | Earlybeta native access+namespace inheritance, rulesets/evaluate vs active/bypass, mirror authority and verify-migration | Origin 1–2; GitHub policy not automatically assumed equivalent |
| Origin Apps, API auth/scopes/webhooks | AppJWT/installation/user delegation; Ed25519/15min/attenuation; repo selection; signed delivery replay/dedupe | Origin 3–4; list app installations not orgwide installed-app inventory |
| Origin provider v0.8.0 and registered provider | Native inbound namespace IP enforcement and SSH CA/requirement; opt-in enforcement with recovery protection | Origin 3.4–3.5; 1.1/2.1 resource+data-source packs; release GitHub v0.8.0 fetched, registry web fetch unavailable; exact-version native initialization subsequently passed |
| Workflow provider, read data source | Creator vs service account scope; detailed Slack/webhook/SCM triggers and write actions; state includes prompt | Cloud 4.1 includes opt-in disabled resource + by-ID native read; no actual trigger/integration installed |
| Model/integration policy | Model access union across team and organization groups; team-only BYOK; Protected Git Scopes; repository blocklist excludes Cloud/Automations/Bugbot | Cursor 2.2 and Cloud 1.1 corrected; effective permission remains live verification |
| Hardening index retention | Enterprise shared transcript retention30–365d, off default; published chat/canvas deletion separate | Cursor2.5; dashboard unavailable, documented configuration only |
| Cyber Safeguards | Organization Group exception; provider terms/retention override for cyber-verified requests only | Cursor2.6; no application/terms acceptance run |
| MCP network | Remote exact URL vs local stdio sandbox network, tools-empty means all; Bot backend switch separate | Cursor4.3 |
| Plugins, skills | Allow Members to Publish on default; old publications remain; private cloud sync separate with team opt-out | Cursor8.3; no undocumented managed-policy key |
| Bot Page sharing | Sharing→Page sharing defaultteam; tightening leaves existingPages shared; rollout-gated | Bot5.5; unavailable UI must remain explicit |
Automation census
| Plane | Terraform resources / data sources | REST / GraphQL | CLI | SDK | Native config / MDM | SIEM |
|---|---|---|---|---|---|---|
| Cursor / Bot | First-party cursor/cursor v0.8.0 registration: 9 resources + 6 data sources, Origin/workflow only; no Bot policy resource found; existing Okta resource is external IdP | Documented team+org Admin REST reads/writes; GraphQL schema unverified | Official Agent CLI/worker; no Bot/team admin commands | Cursor/Agent SDK execution, not assumed team policy admin | Cursor files/MDM; Bot new GUI switches unverified API | Cursor audit and OTel; hook events documented |
| Grok workspace/org | No first-party provider in fetched index | No workspace connector/SCIM/license REST handle established by management reference; GraphQL unverified | grok is Build; no workspace administration handle |
No admin SDK established | Console/IdP GUI; no native managed account policy established | API-team audit not proof of conversation/connector events |
| Grok API | Community XeroSecInc/xai README lists resource xai_api_key and data source xai_api_keys; not vendor-maintained, no acceptance test, not selected over first-party REST |
Management auth/billing/audit + inference/files/collections; GraphQL unverified | No first-party administrative CLI documented in fetched index | Official xAI SDK plus OpenAI-compatible clients; features differ | Per-request payloads, application credentials/endpoints | Audit REST metadata; safety identifier, response headers |
| Grok Build | See separate Build ledger | Execution/backend references only, not inferred team policy API | Official grok CLI |
Backend clients distinct | Root-owned requirements + managed config, policy enforcement caveats | Local hook/log outputs, not equivalent immutable enterprise audit |
| Cloud Agents | First-party platform_workflow resource + by-ID data source (v0.8.0) | Agents, environments, workers/pools, delete, webhooks; team policy writes remain separately verified | Agent worker and runtime CLI | Cursor + Agent SDK | Saved builds/environment JSON; own worker OS/firewall | Team audits/OTel plus run logs; retention limits |
| Origin | First-party Origin grants/rulesets/IP/SSH resources + repository/grant/IP/workflow data sources (v0.8.0) | Large native REST surface: grants/rulesets/apps/keys/webhooks/repositories; GraphQL unverified | Official early-beta origin CRUD/access/rulesets/api; independent of Agent CLI |
REST contract; no separate admin SDK assumed | Git credential helper, app receiver configuration | Signed app webhooks/delivery history; not immutable all-admin audit |
One-type pack coverage is deliberately limited where the only verified automation is a REST or native config surface. An offline request emitter is labeled preparation, never enforcement. GUI-only/unverified settings retain explicit guide verdicts. No fabricated API, provider, Slack scope or source-event schema fills a gap.
Tier 2 and research observations
- Product-name searches of CIS catalog, DISA library and CISA SCuBA found no product-specific Cursor/Grok baseline in the fetched results. CIS now has an AI benchmark; its body/version was not retrieved, so no invented recommendation IDs or broad assertion that no AI benchmark exists. Generic CIS Controls v8/NIST mappings are thematic.
- Vendor current security advisories index remains the primary patch source. The October29 extension incident above supplies a material current mitigation/response source. Third-party summaries did not establish any new undocumented native setting.
- No credentials, vendor CLI installations, API calls, consent grants, actual hooks, live Slack events or destructive lifecycle operations were run. Browser fallback for Build enterprise/hooks read public documentation only. See final validation report for offline/render evidence and remaining limits.
Verified finding records
OWNERSHIP | Present SpaceXSI naming | preserve spacexai URLs, use current visible family name, state plane boundaries | https://x.ai/legal/terms-of-service | Cursor overview/product table and family frontmatter
OMISSION | Shared Slack authority | identify requester/shared computer, owner secrets, personal app grants, requester-only approval vs teammate reset | https://docs.x.ai/grok-bot/shared-bots | Bot5.2–5.4,4.4,7.2
OMISSION | Backend MCP egress | Apply to MCP servers is a separate off-by-default switch | https://docs.x.ai/grok-bot/security | Bot3.4
OMISSION | Sudo default | disable Allow Sudo and restart existing computers | https://docs.x.ai/grok-bot/teams-and-enterprises | Bot3.5
OMISSION | Inference hook beta | signed prompt interception has sampling/failure and Slack reset limits | https://docs.x.ai/grok-bot/inference-hooks | Bot4.4
FACTUAL | Identity proof and partial pass | equal membership is not team identity; partial visibility returns UNKNOWN | https://cursor.com/docs/account/teams/admin-api | shared Bot helper and offline regression tests
OMISSION | New native product planes | add source-backed Grok, API, Build, Cloud Agents and Origin coverage rather than assuming Cursor policy inheritance | https://docs.x.ai/llms.txt | new guides and product map
OMISSION | Extension installation gates | enable documented cooldown/signature policy and link vendor incident remediation | https://cursor.com/help/customization/extensions | Cursor8.2
Provider discovery correction
The initial index-only provider disposition was superseded by complete first-party GitHub v0.8.0 tree, documentation and provider registration reads: 9 registered resources and 6 data sources, release published 2026-10-08, pinned commit 48c8203395b6bdf0043401832415903ddbc1e9ab. The GitHub release/tag exists; tag is unsigned and release asset signatures were not downloaded/verified during that source pass. Registry web fetch was unavailable, so latest-registry state is not asserted. Subsequent isolated native initialization downloaded exact cursor/cursor 0.8.0, verifying developer signature key 5E389DAC0B402A90; see the execution ledger. That act establishes this pinned package’s availability, not the latest release or live tenant behavior. The README’s ~>0.1 constraint is not the version chosen for these examples. Source-backed Terraform adds real write and read coverage rather than a fictional no-provider claim.
Pack selection limits: Auth, files, tools, voice, Cloud worker/secret and Origin token/webhook APIs expose documented operations beyond the supplied inventory/preparation examples. Missing packs for destructive or credential-creating operations do not imply unavailable APIs. Guides identify those contracts and leave reviewed target selection/application authorization explicit. No product account was available to verify enforcement.
Current entitlement/auth migration: Cursor pricing and Bot overview document unified X Subscription tiers with legacy grants retained. Sign-in domains now uses accounts.spacexsi.com with a November30 fallback deadline (year unstated), superseding the repository’s older domains/deadline; Cursor9.2/Bot8.4 updated. Product-doc links canonicalized after fetch: docs.x.ai/overview and cursor.com/docs/origin.