Cursor (Bugbot)
Cursor's PR review layer: Bugbot diff review, Security Agents, PR routing/approval and a PR/merge-queue workspace.
Deployment
Cloud
Languages
Not documented
Pricing model
Per developer seat, Usage-based credits
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Cursor (Bugbot) operates.
5 yes 2 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Partial | Agent Review runs in the Cursor IDE after each commit or via /agent-review; not as-you-type. |
| AI Agent Guardrails | Yes | Bugbot connects to configured MCP servers for extra review tools; Team and Enterprise plans only. |
| Local Analysis (Pre-Commit) | Yes | /review-bugbot reviews branch or uncommitted changes pre-push; patch-ID dedup skips the later PR review. |
| Inline PR Comments | Yes | Posts inline PR comments with explanations, fix suggestions, and Fix in Cursor / Fix in Web links. |
| Quality Gates (Merge Blocking) | Yes | Status check can fail on unresolved issues to block merges; defaults to neutral otherwise. |
| Full Repo Scan | Yes | Security Agents scan codebases for vulnerabilities; Cursor's docs have no dedicated feature page or configuration detail for them. |
| Scheduled Rescans | Partial | Vulnerability Scanner runs cron-based recurring scans of the codebase at rest; beta, Team/Enterprise |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
1 yes 2 partial 10 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Bugbot flags security issues in diffs; Security Agents scan for vulnerabilities, no engine or rule detail. |
| Taint Analysis (Data-Flow) | No | Security docs detail specific check types but never mention cross-function taint tracking |
| Secrets Detection | No | Docs say teams integrate third-party secrets scanners via MCP; not a native check |
| Secrets Validation | No | No native secrets detection, and no mention of testing if a found secret is live |
| SCA | Partial | Vulnerability Scanner flags known vulnerabilities and outdated dependencies; beta, Team/Enterprise |
| Reachability Analysis | No | Anybump marketplace automation template runs reachability analysis on dependency fixes |
| Malicious Package Detection | No | No typosquat or compromised-package detection mentioned across security docs |
| License Compliance | Partial | Only via a custom BUGBOT.md rule naming specific licenses; no native license policy engine |
| SBOM Generation | No | No CycloneDX/SPDX export mentioned anywhere in Bugbot or Security Agents docs |
| IaC Scanning | No | Security Checks section names no categories; no Terraform/K8s/Dockerfile mention found |
| Container Scanning | No | Same Security Checks section is silent on container or base-image scanning |
| CSPM | No | No mention of live cloud account configuration scanning in Security Agents docs |
| DAST | No | Vulnerability Scanner explicitly scans the codebase at rest, static only |
Code quality
2 yes 7 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | Bugbot reports code quality problems alongside bugs and security issues on PR diffs. |
| Complexity Metrics | No | Full 16-section Bugbot docs page never mentions a complexity metric |
| Duplication Detection | No | Same full docs review found no clone or copy-paste detection mentioned |
| Dead Code Detection | No | No dead or unreachable code detection documented |
| Test Coverage Tracking | No | Only a custom rule requiring tests exist; no coverage percent ingestion documented |
| Diff Coverage (New Code) | No | No coverage tracking of any kind is documented, so no new-code metric either |
| Architecture Governance | Yes | ROUTING.md maps products to code boundaries; APPROVAL_POLICY.md sets per-directory review requirements. |
| Technical Debt Quantification | No | No conversion of findings into remediation time or cost documented |
| Behavioral Code Analysis | No | No git-history analytics such as hotspots, churn, or bus factor documented |
AI review & fixes
3 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Bugbot analyzes PR diffs for bugs with Default, High and Custom reasoning-effort levels. |
| PR Summaries & Walkthroughs | Partial | Code Tour walkthroughs and agent diff summaries ship in Cursor Review, currently closed beta. |
| Autofix Suggestions | Yes | Findings include fix suggestions plus Fix in Cursor, Fix in Web, or ask the in-PR agent. |
| Autofix Pull Requests | Yes | Autofix spawns a Cloud Agent pushing to a new or existing branch; needs on-demand usage billing. |
| AI Triage (False-Positive Filtering) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Rules & repo support
2 yes
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | Team Rules, .cursor/BUGBOT.md, learned rules and glob-scoped manual rules merged by precedence. |
| Monorepo Support | Yes | Nested BUGBOT.md discovery upward from changed files, glob-scoped rules, ROUTING.md product boundaries. |
AI capabilities
4 yes 2 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | Bugbot, Security Agents, Agent Review and PR Routing are all LLM agents on Cursor's cloud. |
| Bring Your Own Model | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| MCP Server | Partial | Bugbot consumes configured MCP servers; no MCP server exposing findings. Team and Enterprise only. |
| AI Code Governance | Yes | Usage analytics, AI code tracking API, repository/model/MCP access controls, OpenTelemetry usage export. |
| Conversational Review | Yes | In-PR Cursor Agent answers and applies fixes; '@cursor remember' teaches facts inline. |
| Learning From Feedback | Yes | Learned rules auto-generate from team GitHub activity and are auto-enabled or disabled over time. |
| Code Excluded From Training | Partial | Team-wide Privacy Mode and Legacy Privacy Mode referenced; no explicit training-exclusion statement in Cursor's documentation. |
Models used
Composer
Compliance & governance
3 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Enterprise audit logs cover Bugbot installs, rules and settings; stream to SIEM, S3 or webhooks. |
| SSO (SAML) | Yes | SAML/OIDC SSO listed in Teams Standard plan inclusions. |
| Role-Based Access Control | Yes | Admin versus member roles, per-user Bugbot allow/blocklists, Enterprise repository, model and MCP access controls. |
| Compliance Reporting & Exports | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Certifications
SOC 2 Type IIGDPRHIPAA (BAA available, Enterprise only)
Integrations
8 yes 2 partial
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Partial |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Partial |
IDEs
Cursor
Issue trackers
LinearJira
Chat & notifications
SlackMicrosoft Teams
Pricing & plans
$16/month billed annually for the Individual (Pro) plan ($20/month if billed monthly), plus $1.00-$1.50 per Bugbot review billed usage-based
Trial: 14-day free trial available for all Bugbot plans
HobbyFreeIndividual evaluation
- No credit card required
- Limited Agent requests
- Access to Composer
- PR Inbox with up to 3 default repositories
- No Bugbot or PR-review features
- Limited Agent requests
Pro$20/monthIndividual developers wanting Bugbot
- Extended Agent limits
- Frontier models
- MCPs, skills and hooks
- Cloud agents
- Bugbot with usage-based billing
- Bugbot reviews bill from included usage, overage from on-demand spend
- No PR Routing & Approval or Security Agents
- No Merge Queue
- No MCP tools for Bugbot
Pro+Not publishedHeavier individual users
- 3x Pro Agent limits
- All Pro features
- Bugbot with usage-based billing
- Price not published
- Team-only features still excluded
UltraNot publishedHighest-volume individual users
- 20x Pro Agent limits
- Priority access to new features
- Bugbot with usage-based billing
- Price not published
- Team-only features still excluded
Teams Standard$40/user/monthTeams standardizing review
- Agentic code reviews with Bugbot
- PR Routing & Approval and Security Agents
- Merge Queue
- MCP tools for Bugbot
- Team-wide privacy mode and SAML/OIDC SSO
- Usage analytics and PR Inbox with 30 default repos
- Bugbot review cost layers on top as on-demand spend
- Bugbot Admin API and Public/Analytics API are Enterprise-only
- No audit logs
Teams Premium$40/user/month plus 5x Agent limitsTeams needing larger agent budgets
- Everything in Standard
- Expanded Agent limits
- Price of the 5x Agent limits is not itemized
EnterpriseCustom (contact sales)Large or regulated organizations
- Everything in Teams
- Audit logs and service accounts
- Bugbot Admin API and Public/Analytics API
- SCIM seat management and pooled usage
- HIPAA BAA and Private Connectivity
- OpenTelemetry export (beta) and AI code tracking API
- Quote-only pricing
- OpenTelemetry export still beta
Who it's for
Best for teams that already use Cursor and want review, fixes and merges handled in the same product.
A good fit if
- Your developers work in the Cursor editor
- You want findings fixed by a cloud agent that pushes a fix branch
- You want layered team and repository rules, with an audit of which ones applied
Consider alternatives if
- You need an on-premises deployment
- You need dependency, secrets or IaC scanning
- You need findings to block merges by default
Similar tools
Other PR Review Tool tools in the directory.
CodeAnt AIAI pull-request review platform bundling SAST, SCA, secrets, IaC and multi-cloud posture scanning with IDE and CLI review.CodeRabbitAI pull request reviewer layering 57 third-party linters and a separately metered AI Deep Scan, plus IDE extension and CLI.GreptileAI pull request reviewer that indexes the whole repository graph for context and can execute PR code in a sandbox.QodoAI pull-request review platform with multi-agent review, rules mined from PR history, and remediation agents across four Git providers.
FAQ
When should you choose Cursor (Bugbot)?
Cursor (Bugbot) is best for teams that already use Cursor and want review, fixes and merges handled in the same product. It's a good fit if:
- Your developers work in the Cursor editor
- You want findings fixed by a cloud agent that pushes a fix branch
- You want layered team and repository rules, with an audit of which ones applied
Consider alternatives if:
- You need an on-premises deployment
- You need dependency, secrets or IaC scanning
- You need findings to block merges by default
What languages does Cursor (Bugbot) support?
Cursor (Bugbot)'s documentation doesn't name the languages it supports.
What does Cursor (Bugbot) integrate with?
Cursor (Bugbot) integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps (partial)
- IDEs: Cursor
What tools are similar to Cursor (Bugbot)?
Other PR review tools tracked here:
What are Cursor (Bugbot)'s plans and pricing?
Cursor (Bugbot) has a free plan, and paid plans start at $16/mo. Enterprise pricing is by quote.
Opens cursor.com in a new tab. Review Radar is not affiliated with Cursor.