diff --git a/AGENTS.md b/AGENTS.md
index 23780e00..20ac41e1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -242,3 +242,38 @@ git clone https://github.com/planetscale/skills.git && cd skills && script/setup
 ```
 
 After installing skills, load `14-pscale-cli-automation` for CLI conventions (or re-run `pscale agent-guide --format json` from any `pscale` binary that includes agent onboarding). Use `00-safe-orchestrator` when the user asks for a full PlanetScale assessment.
+
+## Cursor Cloud specific instructions
+
+To install/rebuild the `pscale` binary from this repo (Go 1.26 is on `PATH`):
+
+```bash
+go build -trimpath -o /tmp/pscale ./cmd/pscale && sudo mv -f /tmp/pscale /usr/local/bin/pscale
+```
+
+`/usr/local/bin` is already on `PATH`, so `pscale --version` works afterward. The
+build entry point is `./cmd/pscale` (`main.version`/`main.commit`/`main.date` can be
+set via `-ldflags` if you want an accurate version string). `pscale auth check
+--format json` reports `NO_AUTH` until a user runs `pscale auth login` — installing
+the CLI does not authenticate it.
+
+### `pscale auth login` hangs on the desktop keyring prompt
+
+`pscale` stores its access token via `99designs/keyring`, preferring the
+SecretService (gnome-keyring) backend. In the Cursor Cloud VM the desktop D-Bus
+secret service is present but locked, so after you approve the device flow the CLI
+**blocks on a "Choose password for new keyring" dialog on the desktop** and never
+finishes writing the token (`auth check` keeps reporting `NO_AUTH`).
+
+Work around it by disabling D-Bus so `pscale` falls back to its plaintext file store
+at `~/.config/planetscale/access-token`. Prefix the login (and every subsequent
+`pscale` command, since reads also open the keyring) with:
+
+```bash
+DBUS_SESSION_BUS_ADDRESS=unix:path=/dev/null pscale auth login --format json
+DBUS_SESSION_BUS_ADDRESS=unix:path=/dev/null pscale auth check --format json
+```
+
+Run `login` non-interactively (e.g. in tmux) and hand the user the `verification_url`
++ `user_code` printed as pending JSON on **stderr**; the final result JSON lands on
+**stdout** once approved.