The self-signed root certificate of a local proxy is not on Cursor's built-in certificate pinning list, and in strict verification mode Cursor throws a validation error during the TLS handshake.