An extension is listed and downloadable on open-vsx.org, yet searching for it in Cursor's Extensions panel returns nothing at all. Which conclusion is best supported?

The principle — Cursor routes extension search and downloads through its own marketplace proxy rather than passing requests directly to Open VSX. Before an extension is shown in search or served as a download, Cursor runs automated malware and supply-chain analysis using commercial security tooling, and extensions that fail review are blocked. Cursor also tracks extension-ecosystem threat intelligence and updates the blocklist over time.

Why the key is correct — Because screening happens ahead of both search and download, an extension that exists upstream but never appears in the panel is behaving exactly as a blocked extension behaves. That reading matters for what you do next: the tempting workaround is to fetch the artefact from elsewhere and install it by hand, which puts back the precise risk the proxy removed. Treat absence as a signal about the extension, then look for a maintained alternative.

Why the others are wrong — The proxy is not a passthrough, so upstream availability guarantees nothing about the panel. The verification badge attests to publisher identity rather than code safety, and its absence does not hide anyone from search. And an install cooldown defers new versions for a set number of hours instead of removing an extension from results, which is why it complements marketplace analysis rather than replacing it.

Remember this — A missing extension is often the blocklist working. Sideloading around it undoes the one control that already made a judgement.

Sources — Cursor's Extensions help documentation.