Unfortunately, it looks like code still goes via their servers:

https://cursor.sh/privacy

> Even if you use your API key, your requests will still go through our backend!

> That's where we do our final prompt building.