Cursor Reviewer

An automated, agentic code review runner for Pull Requests. It analyzes code diffs via Cursor SDK, evaluates domain/pipeline rules, and posts surgical thread suggestions directly to your PR on GitHub or Azure DevOps.

31 skills Node.js 22.13+ GitHub & ADO MIT License

Product Overview

🤖 Agentic Core
Powered by Cursor Composer models under the hood. It acts as an autonomous senior code reviewer, performing triages and deep investigations on your PR diffs.
đź“ť Surgical Threads
Only reports actionable problems with clear severity scoring (0–10). Avoids noise and styling nits by enforcing a strict score threshold.
🔄 Cooperative Loop
Integrates seamlessly with local developer IDE agents like solve-pr or goal-fix-pr using standard markers to collaboratively resolve feedback.

How It Works

Two-Phase Review Model

To minimize false positives, the agent analyzes code in two distinct sequential phases:

  1. Phase 1 — Triage: Scans the diff to identify potential bugs, logical issues, security risks, or architectural discrepancies. All non-issues, stylistic nits, and stylistic rules are immediately skipped.
  2. Phase 2 — Investigation: The agent performs structural research on the candidates by readingcaller files, test cases, and adjacent models using read_file and grep_search. An issue is only reported if it satisfies a structured 4-step proof (Evidence, Scenario, Protection Gap, Alternative Discards).

Installation & CI Integration

Local Setup

Configure your .env file with your API key:

CURSOR_API_KEY="your_api_key"

Run dry-run review locally:

npm run review -- --dry-run

GitHub Actions Workflow

Add a workflow block to run on pull requests:

- name: Run Reviewer Agent
  env:
    CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    npx cursor-reviewer --gh --pr-id ${{ github.event.pull_request.number }}

Azure Pipelines

Enable PR comments in Azure DevOps:

- script: |
    npx cursor-reviewer --ado --pr-id $(System.PullRequest.PullRequestId)
  env:
    CURSOR_API_KEY: $(CURSOR_API_KEY)
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

Skill Catalog

spec-to-pr Pipeline (FSM) (13)

Pipeline completo de entrega desde a especificação técnica até o merge da PR.

00-write-spec
Receives a high-level feature description and drafts a canonical step-00-{slug}.spec.md specification.
View skill v3.2
01-write-plan
Generates the initial implementation plan (step-01-{slug}.plan.md) from the specification.
View skill v3.2
02-interview
Audits and interrogates an implementation plan to resolve ambiguities and verify ready criteria before tasks are created.
View skill v1.6
03-plan-to-tasks
Breaks an implementation plan into atomic tasks with files, ACs, and coderPrompts, organized in a DAG topological order.
View skill v2.1
04-implement-tasks
Executes code implementations or fixes defects following a plan, DAG, or code review findings.
View skill v2.1
05-verify-plan
Compares implementation quality and code deliverables against the plan and acceptance criteria.
View skill v2.1
06-code-review
Senior code reviewer — two-phase triage and investigation with defect class generalization. Standalone or workflow Step 9.
View skill v3.1
07-integration-validation
Plans and executes pre-PR integration test batteries, verifying backend, database, RBAC, tenancy, and UI interfaces.
View skill v2.1
08-fix-pr
Cooperatively resolve active PR code review threads on GitHub or Azure DevOps with structured validation and reports.
View skill v1.1
09-goal-fix-pr
Convergence loop — runs fix-pr rounds until all PR threads are resolved or the max iteration cap is reached.
View skill v1.1
10-update-plan-implementation
Post-workflow delta adjustments. Captures manual QA findings, plans delta fixes, implements changes, and updates result summaries.
View skill v1.1
11-ship-pr
End-to-end delivery — verify branch state, commit, push, create PR workingBranch → baseBranch via providers.scm, run goal-fix-pr loops, and merge.
View skill v1.3
spec-to-pr
Spec-to-PR delivery orchestrator FSM (F0–F6, steps 0–12; 13 with `--full`). Agent contract only — not human docs. Invoke: /spec-to-pr | @[spec-to-pr]. Entry: GitHub issue | Azure DevOps work item | *.spec.md | feature description. Flags: dry-run, auto, skip-integration, skip-tests, full, --model, --model-chain. Delegates via Task tool. Legacy aliases: /us-workflow, /us-delivery-workflow.
View skill v1.0

Review & Auditoria de CĂłdigo (9)

Agentes especialistas em auditoria de segurança, performance, arquitetura e domínios.

code-review-self
Code review agêntica executada pelo próprio harness/IDE (opencode) que imita o pipeline cursor-reviewer (@cursor/sdk). Realiza revisão somente-leitura em duas fases, aplica o gate de publicação, controla rodadas/escalonamento e devolve o contrato JSON idêntico ao de src/index.ts. Use quando o usuário pedir "code review self", "revisar PR local", "rodar cursor-reviewer pelo agente", ou revisão agêntica sem o SDK do Cursor.
View skill v1.0
domain-review
Use when the user asks for domain review, bounded-context review, code-review by domain, subdomain audit, or to pick a domain from specs/domains for smells/security/SOLID/perf. Also when they say /domain-review, /domain-review next, /domain-review auto, or /domain-review next auto (auto-pick + optional full fix/PR/goal-fix-pr cycle).
View skill v1.0
dotnet-security-performance-review
Perform C# security and performance code reviews for login, authorization, and database access. Use when auditing backend auth, checking EF transactions, database queries, roles, impersonation safety, or optimizing API endpoints.
View skill v1.0
megabrain
Revisor de código com threads persistentes entre rodadas de review. Atribui IDs cronológicos a cada issue, avalia correções do desenvolvedor contra threads abertas e evita repetir feedback histórico ou perder issues não resolvidas. Use ao revisar PRs iterativamente, acompanhar threads em múltiplos commits ou conduzir follow-ups após correções do desenvolvedor.
View skill v1.0
multi-domain-review
Use when the user asks to review multiple domains, batch domain-review, rotate all stale/never-reviewed domains, or says /multi-domain-review, multi-domain review, review all domains, or domain-review queue/batch with the 7-day freshness window.
View skill v1.0
secrets-leak-review
Scans repository for hardcoded secrets, passwords, API keys, PII, private keys, connection strings, .env files, and client-confidential data before commit. Use when asked to "check for secrets", "leak check", "secrets scan", "pre-commit security check", "check for hardcoded passwords", "PII scan", "repo leak audit", or before pushing to a public repository.
View skill v1.0
security-review
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
View skill v1.0
solve-pr
Skill agêntica para buscar as threads ativas de uma PR do GitHub, analisar os problemas, propor correções, implementar soluções, fazer commit, push e aguardar a próxima rodada de code review.
View skill v1.0
tdd-sdd-ddd-reviewer
Architectural audit (TDD, spec-driven design, DDD) for C# .NET backends and React frontends. Use when explicitly asked for clean-architecture, layer-boundary, or TDD/DDD review — not default PR review.
View skill v1.0

Utilidades & Frontend (9)

Diretrizes gerais de design, boas práticas e geradores de novos agentes.

azure-devops-provider
Azure DevOps provider for spec-to-pr — work item→spec, PAT auth, PR create/threads/merge via az CLI and/or REST plus provider scripts. Use when providers.active or providers.scm is azure-devops, or when invoking /azure-devops-provider standalone.
View skill v1.0
check-harness
Audit harness integrity — validates AGENTS.md routing, detects broken links, orphan skills/rules, absolute paths, redundancy, and portability issues. Read-only scan → correction plan → apply with approval.
View skill v3.1-generic
check-workflows
Auto-check workflow processes (spec-to-pr & spec-to-pr-lite) for step continuity, config sharing, state isolation, compatibility, and provider references. Use when validating orchestrators, adding steps, or testing workflow changes.
View skill v1.0
design-taste-frontend
Anti-slop frontend skill for landing pages, portfolios, and redesigns. The agent reads the brief, infers the right design direction, and ships interfaces that do not look templated. Real design systems when applicable, audit-first on redesigns, strict pre-flight check.
View skill v1.0
github-provider
GitHub provider for spec-to-pr — issue→spec, auth checks, PR create/threads/merge via gh CLI and provider scripts. Use when providers.active or providers.scm is github, or when invoking /github-provider standalone.
View skill v1.0
local-spec-provider
Local markdown spec provider for spec-to-pr — detect/configure specsDir, register/normalize/mirror hand-written *.spec.md into canonical step-00 artifacts (source: local). PR intents delegate to providers.scm. Use when /local-spec-provider, active provider is local, or registering a local *.spec.md path.
View skill v1.0
mobile-first-design
Design for mobile devices first, then scale up to larger screens. Create responsive interfaces that work seamlessly across all device sizes.
View skill v1.0
spec-to-pr-lite
Spec-to-PR lite delivery orchestrator FSM. Runs a fast, sequential planning-to-review pipeline. Invoke: /spec-to-pr-lite | @[spec-to-pr-lite]. Entry: GitHub issue | Azure DevOps work item | *.spec.md. Flags: dry-run, auto, skip-tests, full, --model, --model-chain. Delegates via Task tool.
View skill v1.0
write-a-skill
Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.
View skill v1.0