Cursor (Bugbot)

Agent Review runs in the Cursor IDE after each commit or via /agent-review; not as-you-type.

Bugbot connects to configured MCP servers for extra review tools; Team and Enterprise plans only.

/review-bugbot reviews branch or uncommitted changes pre-push; patch-ID dedup skips the later PR review.

Posts inline PR comments with explanations, fix suggestions, and Fix in Cursor / Fix in Web links.

Status check can fail on unresolved issues to block merges; defaults to neutral otherwise.

Security Agents scan codebases for vulnerabilities; source has no dedicated feature page or configuration detail.

Vulnerability Scanner runs cron-based recurring scans of the codebase at rest; beta, Team/Enterprise

Not offered in vendor documentation reviewed as of 2026-09-05.

Bugbot flags security issues in diffs; Security Agents scan for vulnerabilities, no engine or rule detail.

Security docs detail specific check types but never mention cross-function taint tracking

Docs say teams integrate third-party secrets scanners via MCP; not a native check

No native secrets detection, and no mention of testing if a found secret is live

Vulnerability Scanner flags known vulnerabilities and outdated dependencies; beta, Team/Enterprise

Anybump marketplace automation template runs reachability analysis on dependency fixes

No typosquat or compromised-package detection mentioned across security docs

Only via a custom BUGBOT.md rule naming specific licenses; no native license policy engine

No CycloneDX/SPDX export mentioned anywhere in Bugbot or Security Agents docs

Security Checks section names no categories; no Terraform/K8s/Dockerfile mention found

Same Security Checks section is silent on container or base-image scanning

No mention of live cloud account configuration scanning in Security Agents docs

Vulnerability Scanner explicitly scans the codebase at rest, static only

Bugbot reports code quality problems alongside bugs and security issues on PR diffs.

Full 16-section Bugbot docs page never mentions a complexity metric

Same full docs review found no clone or copy-paste detection mentioned

No dead or unreachable code detection documented

Only a custom rule requiring tests exist; no coverage percent ingestion documented

No coverage tracking of any kind is documented, so no new-code metric either

ROUTING.md maps products to code boundaries; APPROVAL_POLICY.md sets per-directory review requirements.

No conversion of findings into remediation time or cost documented

No git-history analytics such as hotspots, churn, or bus factor documented

Bugbot analyzes PR diffs for bugs with Default, High and Custom reasoning-effort levels.

Code Tour walkthroughs and agent diff summaries ship in Cursor Review, currently closed beta.

Team Rules, .cursor/BUGBOT.md, learned rules and glob-scoped manual rules merged by precedence.

Findings include fix suggestions plus Fix in Cursor, Fix in Web, or ask the in-PR agent.

Autofix spawns a Cloud Agent pushing to a new or existing branch; needs on-demand usage billing.

Not offered in vendor documentation reviewed as of 2026-09-05.

Nested BUGBOT.md discovery upward from changed files, glob-scoped rules, ROUTING.md product boundaries.

Bugbot, Security Agents, Agent Review and PR Routing are all LLM agents on Cursor's cloud.

Not offered in vendor documentation reviewed as of 2026-09-05.

Bugbot consumes configured MCP servers; no MCP server exposing findings. Team and Enterprise only.

Usage analytics, AI code tracking API, repository/model/MCP access controls, OpenTelemetry usage export.

In-PR Cursor Agent answers and applies fixes; '@cursor remember' teaches facts inline.

Learned rules auto-generate from team GitHub activity and are auto-enabled or disabled over time.

Team-wide Privacy Mode and Legacy Privacy Mode referenced; no explicit training-exclusion statement in source.

Enterprise audit logs cover Bugbot installs, rules and settings; stream to SIEM, S3 or webhooks.

SAML/OIDC SSO listed in Teams Standard plan inclusions.

Admin versus member roles, per-user Bugbot allow/blocklists, Enterprise repository, model and MCP access controls.

Not offered in vendor documentation reviewed as of 2026-09-05.