Cursor Apollo Sandbox
Fill Apollo Server Sandbox inside Cursor's embedded browser for any Apollo GraphQL project — formatted operation, pretty JSON variables, and auto-detected request headers. No Chrome, no CDP patches, no restart.
Cursor only — uses cursor.browserView.* APIs. Does not run in VS Code.
Install from Marketplace
Search Cursor Apollo Sandbox in Cursor Extensions, or:
ext install boobuh.cursor-apollo-sandbox
Install from source
git clone https://github.com/Boobuh/cursor-apollo-sandbox.git
cd cursor-apollo-sandbox
npm install
npm run build
ln -s "$(pwd)" ~/.cursor/extensions/cursor-apollo-sandbox
Reload Cursor. Set apolloSandbox.graphqlUrl and your default operation.
Publish (maintainers)
# One-time: create publisher "boobuh" at marketplace.visualstudio.com
npx @vscode/vsce login boobuh
npm run package # creates .vsix
VSCE_PAT=*** npm run publish:marketplace
See scripts/publish.sh for details.
Requirements
- Cursor with embedded Browser tab (
cursor.browserView.* commands)
- An Apollo Server GraphQL endpoint (local or remote)
- Optional: a logged-in frontend tab on the same host (improves header detection)
Quick start
- Open your app in the Cursor browser (logged in) and/or the GraphQL Sandbox URL.
- Run Apollo Sandbox: Setup (auto-detect + fill).
The extension discovers headers automatically — no manual copy/paste.
Before fill or run, the extension:
- Listens for GraphQL
fetch/XHR on open tabs (same host as graphqlUrl / authCaptureUrl)
- Scans
localStorage / sessionStorage for Bearer tokens and common custom headers (x-company-id, x-tenant-id, etc.)
- Probes your endpoint with
{ __typename } — tries cookie-only, then each candidate header set
- Persists the working set to Sandbox + parent-page relay
Public cookie-only APIs: probe succeeds with {} headers. Bearer APIs: token picked up from traffic or storage.
Commands
| Command |
What it does |
| Setup (auto-detect + fill) |
Detect headers → fill Sandbox |
| Auto-detect Headers |
Run detection only (shows sources: traffic, storage, probe) |
| Fill Sandbox |
Auto-detect → reload iframe with operation + variables + headers |
| Run Operation (parent fetch) |
Auto-detect → POST configured operation |
| Open GraphQL Endpoint |
Open graphqlUrl in a browser tab |
Command Palette → Apollo Sandbox.
Settings
| Key |
Default |
Description |
apolloSandbox.graphqlUrl |
http://localhost:4000/graphql |
Apollo Server Sandbox / GraphQL endpoint |
apolloSandbox.authCaptureUrl |
(empty) |
Extra page to scan (SPA dashboard); same host tabs are scanned automatically |
apolloSandbox.graphqlUrlMatch |
(auto) |
URL substring for GraphQL traffic |
apolloSandbox.defaultOperation |
query ExampleQuery { __typename } |
Multi-line operation |
apolloSandbox.defaultVariables |
{} |
JSON variables |
apolloSandbox.headerDetectMs |
6000 |
Listen + probe timeout (ms) |
apolloSandbox.sandboxWaitMs |
9000 |
Wait after iframe reload (ms) |
How it works
Apollo Sandbox runs in a cross-origin iframe. This extension:
- Auto-detects headers from live traffic, browser storage, and endpoint probes
- Rebuilds the embed URL with Apollo's
document, variables, and headers params
- Relays Sandbox Run via
postMessage on the parent page (credentials: include for cookies)
License
MIT
