Menu
Optimize Cursor IDE performance: reduce memory usage, speed up indexing, tune AI features, and manage extensions for large codebases. Triggers on "cursor performance", "cursor slow", "cursor optimization", "cursor memory", "speed up cursor", "cursor lag".
| name | cursor-performance-tuning |
| description | Optimize Cursor IDE performance: reduce memory usage, speed up indexing, tune AI features, and manage extensions for large codebases. Triggers on "cursor performance", "cursor slow", "cursor optimization", "cursor memory", "speed up cursor", "cursor lag". |
| allowed-tools | Read, Write, Edit, Bash(cmd:*) |
| version | 1.0.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","cursor","performance"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Diagnose and fix Cursor IDE performance issues. Covers editor optimization, indexing tuning, extension auditing, AI feature configuration, and strategies for large codebases.
Step 1: Identify bottleneck
├── Editor lag? → Step 2 (Editor settings)
├── High CPU? → Step 3 (Extension audit)
├── Slow AI? → Step 4 (AI tuning)
└── Memory? → Step 5 (Memory management)
Step 2: Editor settings
├── Disable minimap, breadcrumbs
├── Reduce file watcher scope
└── Increase memory limits
Step 3: Extension audit
├── Profile running extensions
├── Disable heavy extensions
└── Use workspace-scoped disabling
Step 4: AI feature tuning
├── Optimize .cursorignore
├── Use faster models
└── Manage chat history
Step 5: Memory management
├── Close unused workspace folders
├── Limit open editor tabs
└── Clear caches
{
// Disable visual features for speed
"editor.minimap.enabled": false,
"editor.renderWhitespace": "none",
"editor.guides.bracketPairs": false,
"breadcrumbs.enabled": false,
"editor.occurrencesHighlight": "off",
"editor.matchBrackets": "never",
"editor.folding": false,
"editor.glyphMargin": false,
// Reduce file watching scope
"files.watcherExclude": {
"**/node_modules/**": true,
"**/.git/objects/**": true,
"**/.git/subtree-cache/**": true,
"**/dist/**": true,
"**/build/**": true,
"**/coverage/**": true,
"**/.next/**": true,
"**/target/**": true
},
// Exclude from search and explorer
"files.exclude": {
"**/node_modules": true,
"**/.git": true,
"**/dist": true,
"**/build": true
},
// Memory limits
"files.maxMemoryForLargeFilesMB": 4096,
// Reduce auto-save overhead
"files.autoSave": "onFocusChange",
// Limit search results
"search.maxResults": 5000
}
{
"workbench.list.smoothScrolling": false,
"editor.smoothScrolling": false,
"editor.cursorSmoothCaretAnimation": "off",
"terminal.integrated.smoothScrolling": false
}
Cmd+Shift+P > Developer: Show Running Extensions
This shows:
Sort by activation time. Extensions taking > 500ms are worth investigating.
Cmd+Shift+P > Developer: Open Process Explorer
Shows per-process CPU and memory usage:
| Extension | Impact | Mitigation |
|---|---|---|
| GitLens | CPU: high on large repos | Disable for repos > 50K commits or use lightweight mode |
| Prettier | CPU: triggers on every save | Set "editor.formatOnSave": false, format manually |
| TypeScript | Memory: large projects | Increase "typescript.tsserver.maxTsServerMemory": 4096 |
| ESLint | CPU: validates on type | Set "eslint.run": "onSave" instead of "onType" |
| Spell Checker | CPU: large files | Add exclusion patterns for generated files |
| Import Cost | CPU: recalculates on change | Disable for projects with many imports |
Right-click extension > Disable (Workspace). This keeps the extension available for other projects while removing it from the current slow one.
The biggest performance lever for AI features:
# .cursorignore -- aggressive exclusion for large projects
node_modules/
dist/
build/
.next/
out/
target/
coverage/
.turbo/
.cache/
__pycache__/
*.pyc
venv/
.venv/
# Generated code
*.min.js
*.min.css
*.bundle.js
*.d.ts.map
*.tsbuildinfo
# Data files
*.csv
*.json.gz
*.parquet
*.sqlite
*.sql
# Lock files
package-lock.json
yarn.lock
pnpm-lock.yaml
Cargo.lock
# Media
*.png
*.jpg
*.gif
*.svg
*.mp4
*.woff2
# Documentation build output
docs/dist/
docs/.vitepress/dist/
Tab completion is fast by design (~100ms), but can feel slow if:
| Factor | Impact | Fix |
|---|---|---|
| Model choice | Opus/o1 are slower than Sonnet/GPT-4o | Use faster models for simple tasks |
| Context size | More @-mentions = slower | Use @Files not @Codebase when possible |
| Conversation length | Long chats slow down | Start new chat frequently |
| Server load | Peak hours are slower | Use off-peak or BYOK |
Long chat sessions consume memory and slow down responses:
Signs of chat-related slowdown:
- Typing lag in the chat input
- Editor becomes sluggish after extended chat session
- AI responses take progressively longer
Fix:
1. Start a new chat (Cmd+N in chat panel)
2. Close old chat tabs
3. One topic per chat session
1. Open specific packages, not the whole monorepo
cursor packages/api/ # Not: cursor .
2. Aggressive .cursorignore (see above)
3. Multi-root workspace with only active packages
File > Add Folder to Workspace (selectively)
4. Disable codebase indexing if not needed
Cursor Settings > Features > Codebase Indexing > off
(You lose @Codebase but gain performance)
5. Increase system resources
Close other Electron apps (Slack, Teams, Discord)
Increase swap space on Linux
# Check current limit
cat /proc/sys/fs/inotify/max_user_watches
# Increase (required for large projects)
echo "fs.inotify.max_user_watches=524288" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
# macOS: Monitor Cursor memory usage
top -pid $(pgrep -f "Cursor")
# Linux: Monitor Cursor processes
ps aux | grep -i cursor | sort -rn -k4
# If memory exceeds 4GB consistently:
# 1. Close unused workspace folders
# 2. Limit open editor tabs to ~20
# 3. Restart Cursor daily during heavy use
# macOS
rm -rf ~/Library/Application\ Support/Cursor/Cache/
rm -rf ~/Library/Application\ Support/Cursor/CachedData/
rm -rf ~/Library/Application\ Support/Cursor/Code\ Cache/
# Linux
rm -rf ~/.config/Cursor/Cache/
rm -rf ~/.config/Cursor/CachedData/
rm -rf ~/.config/Cursor/Code\ Cache/
Restart Cursor after clearing. Caches rebuild automatically.
Cursor stores extension data in SQLite databases. If the storage directory grows large:
# Check size (macOS)
du -sh ~/Library/Application\ Support/Cursor/
# If > 2GB, clearing Cache/ and CachedData/ usually reclaims most space
settings.json to all team membersAudit a Node.js project's installed npm dependency tree for known CVEs by wrapping the npm audit JSON output and emitting findings in the canonical penetration-tester schema. Detects direct AND transitive vulnerabilities, normalizes npm's severity scale (info/low/moderate/ high/critical) to the shared Severity enum, and parses both v1 and v2 audit output formats so the skill works against npm 6 and npm 7+ lockfiles. Use when: pre-merge gate on a Node project, post-incident sweep after a transitive package compromise (e.g. event-stream, ua-parser, node-ipc, color.js), SOC2 vendor-management evidence collection, or auditing an inherited or acquired Node codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit npm deps", "npm vulnerability scan", "check node packages for CVEs", "npm audit".
Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".
Audit a project's dependency licenses against an explicit policy (allow-list / deny-list / review-required) and flag incompatibilities before they ship to production. Reads SPDX license identifiers from npm package manifests, Python METADATA / PKG-INFO files, and pyproject.toml; classifies each license by family (permissive, weak-copyleft, strong-copyleft, proprietary, unknown); detects copyleft contamination and SPDX-incompatible license combinations. Use when: pre-release legal review, M&A code-audit due diligence, preparing an OSS attribution NOTICE file, or switching a project's own license. Threshold: any GPL-family license in a project declaring MIT or Apache-2.0; any UNKNOWN-license package; any metadata-vs-source license mismatch. Trigger with: "check licenses", "license compliance audit", "SPDX scan", "GPL contamination check".
Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding sections (title, severity, target, detail, remediation, evidence) and a top-level summary table. The canonical written artifact a customer receives at engagement close; precise, reproducible, machine- checkable against source findings. Use when: closing an engagement, generating an interim report, regenerating after CVE or OWASP enrichment, or producing the input for generating-executive-summary. Threshold: findings missing required fields are dropped. HIGH and CRITICAL findings highlighted in the summary section. Trigger with: "compose vuln report", "write pentest report", "generate vulnerability deliverable", "render findings to report".
Verify that a penetration test has explicit, written, signed authorization before any scanning begins. Reads a Rules-of- Engagement (ROE) attestation file, validates required fields (authorizer, in-scope targets, time window, emergency contact, signature), checks the signer against an allowlist, and emits a CRITICAL finding if anything is missing. Designed as the first skill the orchestrator routes to. Use when: starting a new engagement, after a scope change, or before any cluster 1-4 scan skill runs. Threshold: any missing or unsigned ROE field; any time-window expiry; any in-scope target outside the authorized list. Trigger with: "confirm authorization", "verify ROE", "check pentest authz", "pre-flight authorization".
Parse the ROE scope definition, enumerate every in-scope target (hostnames, IPs, CIDRs, URLs, cloud accounts, SaaS tenants), validate syntax, detect overlap with out-of-scope or known third-party SaaS ranges, and emit a normalized target list plus IP allowlist for scanning tools. Runs after confirming-pentest- authorization and before any cluster 1-4 scan. Use when: starting an engagement, expanding scope mid-engagement, validating that a target list matches the ROE, or generating an allowlist for an external scanner. Threshold: malformed syntax, in-scope overlap with out-of-scope, reserved or third-party SaaS ranges without acknowledgement. Trigger with: "define scope", "enumerate targets", "validate target list", "generate IP allowlist".