Deploy Grok Bot to your organization

Your IT team installs the Grok Bot desktop app on member devices with the tools it already uses for other software: download a versioned installer, push it, and decide when devices move to a new release. Dashboard controls for turning Grok Bot on and scoping access are on Grok Bot for teams and enterprises.

The apps are clients for chat, review, and approvals. Bots do their work on the member's hosted computer. Your device management tool reaches the apps on member devices and stops there: the hosted computer runs Linux in the cloud and isn't enrolled in MDM. To put your own tooling on hosted computers, Enterprise teams use Team Setup scripts.

• The Download Grok Bot row on the Grok Bot page of the dashboard installs the app or copies a link you can share with members.
• The download page lists the current installer for every platform and format.
• For scripted packaging, read the current release from the release feed and download the file it names.

Each platform has a JSON feed at https://api2.cursor.sh/updates/api/download/stable/{platform}/sand:

curl -s https://api2.cursor.sh/updates/api/download/stable/darwin-arm64/sand

The fields you need:

The response can carry other fields; installing the desktop app doesn't need them.

macOS and Windows installers keep a versioned URL for each release. Replace {version} with the release you want:

# macOS, Apple silicon
https://downloads.cursor.com/grokbot/stable/darwin-arm64/{version}/Grok_Bot_{version}.dmg

# macOS, Intel
https://downloads.cursor.com/grokbot/stable/darwin-x64/{version}/Grok_Bot_{version}_x64.dmg

# Windows x64
https://downloads.cursor.com/grokbot/stable/win32-x64/{version}/Grok_Bot_{version}_Setup.exe

# Windows Arm64
https://downloads.cursor.com/grokbot/stable/win32-arm64/{version}/Grok_Bot_{version}_Setup.exe

Linux packages sit under the release's commitSha, in https://downloads.cursor.com/grokbot/stable/{commitSha}/linux/x64/ or .../linux/arm64/. Copy the exact file URLs from downloadUrl, debUrl, and rpmUrl in the Linux feed.

• On macOS, deploy the .dmg with the Mac management tool you run today, such as Jamf Pro, Kandji, or Microsoft Intune.
• On Windows, deploy the Setup .exe with Intune, Configuration Manager, or another software distribution tool, and install silently with Grok_Bot_{version}_Setup.exe /S. The installer installs per user, into the member's profile under %LOCALAPPDATA%\Programs, so deploy it in user context, not as SYSTEM. Test the install on a pilot device before you push it.
• On Linux, install the .deb or .rpm with your configuration management tool, such as Ansible, Puppet, or Chef. Prefer these packages for managed fleets: package installs update through your package manager on your schedule. See Linux package updates.
• On iPhone, members install Grok Bot from the App Store on iOS 18 or later.
• On Android, members install Grok Bot from Google Play on Android 9 or later. To push it to managed devices, approve it in managed Google Play from Intune or another Android device management tool.

Members sign in through your normal SSO flow; Grok Bot has no separate login. To assign the Cursor app in Okta or Entra ID, see Assign the Cursor app.

Pin the version you tested. Download that release's installer, keep it in your own software repository or MDM package store, and deploy from your copy so every new device gets the same build. How long older installers stay available for download isn't published, and a pinned build works only until it loses support; see How desktop updates work.

Linux package URLs include the release's commitSha, so record the full URL along with the version.

To check what a device runs, open the account menu in the app, choose Support, then About. The dialog shows Version, and Copy version info copies the version, release track, and operating system.

For macOS, Windows, and AppImage installs, no device policy, installer option, or dashboard setting turns off desktop app updates. Pinning decides which version you install; the app still offers newer ones afterward.

Old builds stop working. When a build loses support, the app covers its whole window with Update required until the member updates. A build loses support when it falls below the minimum supported version, or when it passes a maximum age and a newer release is available. This applies to every install, including Linux .deb and .rpm packages. Both limits are set remotely and aren't published, so plan a regular cadence for moving devices to the current release.

Installing the .deb adds a signed apt repository at /etc/apt/sources.list.d/grok-bot.sources, and installing the .rpm adds a signed repository at /etc/yum.repos.d/grok-bot.repo. Devices then pick up new Grok Bot versions whenever they run package upgrades.

To control when Linux devices move, either:

• Hold the package with your package manager, such as apt-mark hold grok-bot, and release it when you're ready to upgrade.
• Turn the repository off: set Enabled: no in grok-bot.sources, or enabled=0 in grok-bot.repo. The package rewrites these files on every install and upgrade and keeps your choice. Then ship new versions yourself from package files you've tested.

Either way, upgrade before the installed version loses support. A held package still gets the Update required screen.

The hosted computer's image is maintained for you, so there is no image for you to pin or supply. A computer moves to a newer image in one of three ways:

Running computers pick up Team Setup manifest changes roughly once a day; to apply a change sooner, recreate the computers. On Enterprise, audit logs record computer updates, resets, recreates, and terminations as grok_bot_vm events, and operations across many members as grok_bot_vm_bulk.

Devices download installers and desktop updates from cursor.com and downloads.cursor.com, and the app reaches its API and the member's hosted computer on the domains in Allow these domain patterns. Allow all of them, including the nested *.*.cursorvm.com pattern, and exempt them from TLS inspection before you push the app.

1. Move off Privacy Mode (Legacy), which blocks Grok Bot entirely. See Before you roll out.
2. Clear your network: allow the Grok Bot domains on your gateway and exempt them from TLS inspection. See Configure TLS-inspecting proxies.
3. Assign the Cursor app in your identity provider, since Grok Bot sign-in uses your SSO. See Assign the Cursor app.
4. Turn on Grok Bot and choose who gets it. On Enterprise, an admin turns Grok Bot on from the dashboard and scopes it with Manage Group Access; on Teams, every member already has access. See Enabling Grok Bot for your team.
5. Set the admin controls in Recommended configuration before members start.
6. Pilot the installer: install your chosen version on a few devices for each platform, sign in, and confirm the app connects to the hosted computer.
7. Deploy the tested installer to every device whose owner has access.
8. Pick a cadence for moving devices to new releases. For Linux, decide whether devices upgrade from the Grok Bot repository or from packages you ship.

On macOS, Windows, and AppImage installs, no. The app checks for updates and offers them to members. Linux .deb and .rpm installs don't update themselves, so you control them with your package manager. See How desktop updates work.

The published installers are a .dmg for macOS, a Setup .exe for Windows, and a .deb, .rpm, or AppImage for Linux. Wrap the .dmg or .exe in your management tool's package format if it requires one.

No. The hosted computer runs Linux in the cloud and isn't enrolled in MDM. Enterprise teams install their own tooling on it with Team Setup. If your identity provider requires a managed device, see Allow sign-in to IdP apps from the computer.

No. The image is maintained for you, and computers move to new images in the background. Enterprise organization admins can recreate computers at a time they choose from Manage Bot Computers.

Yes, unless your device policies block it. Members can download the app from the dashboard link an admin shares or from the download page. Access still depends on your plan and, on Enterprise, on Manage Group Access.

• Grok Bot for teams and enterprises
• Configure identity and access
• Connect to private networks
• Configure TLS-inspecting proxies
• Manage Grok Bot computers
• Settings and notifications

Contact your account team about Enterprise enablement, deployment planning, and security review support.