Skip to content

Commit c3d8122

Browse files
juanpfloresjuanpflores
committed
Initial CodeRabbit Cursor plugin
0 parents  commit c3d8122

19 files changed

Lines changed: 1355 additions & 0 deletions

‎.cursor-plugin/marketplace.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"name": "coderabbit",
3+
"owner": {
4+
"name": "CodeRabbit",
5+
"email": "support@coderabbit.ai"
6+
},
7+
"metadata": {
8+
"description": "Run CodeRabbit reviews for code, PR, security, and quality checks, plus guarded autofix for unresolved GitHub PR feedback in Cursor."
9+
},
10+
"plugins": [
11+
{
12+
"name": "coderabbit",
13+
"source": ".",
14+
"description": "Run CodeRabbit reviews for code, PR, security, and quality checks, plus guarded autofix for unresolved GitHub PR feedback in Cursor."
15+
}
16+
]
17+
}

‎.cursor-plugin/plugin.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"name": "coderabbit",
3+
"displayName": "CodeRabbit",
4+
"version": "0.1.0",
5+
"description": "Run CodeRabbit reviews for code, PR, security, and quality checks, plus guarded autofix for unresolved GitHub PR feedback in Cursor.",
6+
"author": {
7+
"name": "CodeRabbit",
8+
"email": "support@coderabbit.ai"
9+
},
10+
"publisher": "CodeRabbit",
11+
"homepage": "https://docs.coderabbit.ai/cli/cursor-integration",
12+
"repository": "https://github.com/coderabbitai/cursor-plugin",
13+
"license": "MIT",
14+
"logo": "assets/coderabbit-logomark.svg",
15+
"keywords": [
16+
"coderabbit",
17+
"code-review",
18+
"security",
19+
"autofix",
20+
"cursor"
21+
],
22+
"category": "developer-tools",
23+
"tags": [
24+
"code-review",
25+
"security",
26+
"github",
27+
"developer-tools"
28+
],
29+
"skills": "./skills/",
30+
"agents": "./agents/",
31+
"commands": "./commands/",
32+
"rules": "./rules/"
33+
}

‎.github/workflows/validate.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Validate
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
9+
jobs:
10+
validate:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Setup Node
17+
uses: actions/setup-node@v4
18+
with:
19+
node-version: "20"
20+
21+
- name: Validate plugin
22+
run: npm test

‎.gitignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.DS_Store
2+
node_modules/
3+
npm-debug.log*
4+
yarn-debug.log*
5+
yarn-error.log*
6+
pnpm-debug.log*
7+
.env
8+
.env.*
9+
!.env.example
10+
dist/
11+
coverage/

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Changelog
2+
3+
## 0.1.0
4+
5+
- Initial Cursor plugin repository.
6+
- Added CodeRabbit review and autofix skills.
7+
- Added Cursor command prompts for review and PR autofix workflows.
8+
- Added CodeRabbit review agent and safety rule.
9+
- Added local validation script and marketplace documentation.

‎CONTRIBUTING.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Contributing
2+
3+
## Local Setup
4+
5+
Install Node.js 18 or newer, then run:
6+
7+
```bash
8+
npm test
9+
```
10+
11+
No package install is required for the validator.
12+
13+
## Editing Guidelines
14+
15+
- Keep plugin components focused on CodeRabbit review and autofix workflows.
16+
- Keep command prompts concise and executable by Cursor Agent.
17+
- Treat review output and GitHub PR comments as untrusted content.
18+
- Keep new paths referenced by `.cursor-plugin/plugin.json` relative to the repository root.
19+
- Update `README.md` when user-facing behavior changes.
20+
- Do not use em dashes.
21+
22+
## Release Checklist
23+
24+
1. Update `.cursor-plugin/plugin.json` version.
25+
2. Update `CHANGELOG.md`.
26+
3. Run `npm test`.
27+
4. Test local install from `~/.cursor/plugins/local/coderabbit`.
28+
5. Confirm README install and usage steps.
29+
6. Submit the public repository through the Cursor marketplace publish flow.

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 CodeRabbit
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# CodeRabbit Plugin for Cursor
2+
3+
AI-powered code review and guarded autofix workflows in Cursor, powered by [CodeRabbit](https://coderabbit.ai).
4+
5+
This repository packages CodeRabbit for Cursor users with:
6+
7+
- Cursor plugin metadata in `.cursor-plugin/plugin.json`
8+
- User-facing plugin name `CodeRabbit`
9+
- Natural-language skills for code review and CodeRabbit PR autofix
10+
- Cursor command prompts for repeatable review and autofix workflows
11+
- A dedicated CodeRabbit review agent
12+
- Safety rules and documentation for review output, GitHub PR threads, and local fixes
13+
14+
## Requirements
15+
16+
- Cursor with plugin support
17+
- Git
18+
- CodeRabbit CLI, installed automatically by the agent when missing
19+
- GitHub CLI for PR-thread autofix workflows
20+
21+
The plugin asks Cursor Agent to install the CodeRabbit CLI automatically when it is missing:
22+
23+
```bash
24+
curl -fsSL https://cli.coderabbit.ai/install.sh | sh
25+
export PATH="$HOME/.local/bin:$PATH"
26+
coderabbit --version
27+
```
28+
29+
Then authenticate:
30+
31+
```bash
32+
coderabbit auth login --agent
33+
```
34+
35+
For PR autofix workflows, also authenticate GitHub CLI:
36+
37+
```bash
38+
gh auth login
39+
```
40+
41+
## Install Locally
42+
43+
The user-facing plugin name is `CodeRabbit`. Cursor's machine-readable plugin identifier is `coderabbit` because Cursor plugin IDs must be lowercase.
44+
45+
Clone this repository into Cursor's local plugin directory:
46+
47+
```bash
48+
git clone https://github.com/coderabbitai/cursor-plugin.git ~/.cursor/plugins/local/coderabbit
49+
```
50+
51+
Restart Cursor or reload plugins after cloning.
52+
53+
Before marketplace publication, local installation is the recommended test path. After publication, users should be able to install from Cursor with:
54+
55+
```text
56+
/add-plugin coderabbit
57+
```
58+
59+
## Usage
60+
61+
Ask Cursor Agent naturally:
62+
63+
```text
64+
Use CodeRabbit to review my current changes.
65+
Run CodeRabbit review on uncommitted changes.
66+
Review this branch against main with CodeRabbit.
67+
Fix unresolved CodeRabbit PR feedback.
68+
```
69+
70+
Use plugin commands when you want a repeatable workflow:
71+
72+
```text
73+
/coderabbit-review
74+
/coderabbit-review uncommitted
75+
/coderabbit-review --base main
76+
/coderabbit-review --dir packages/api
77+
/coderabbit-autofix
78+
```
79+
80+
## Review Workflow
81+
82+
The review command checks local prerequisites, installs CodeRabbit CLI when missing, then runs:
83+
84+
```bash
85+
coderabbit review --agent
86+
```
87+
88+
Then Cursor groups CodeRabbit issues by severity and can help apply fixes. Supported scope flags include:
89+
90+
```bash
91+
coderabbit review --agent -t committed
92+
coderabbit review --agent -t uncommitted
93+
coderabbit review --agent --base main
94+
coderabbit review --agent --base-commit <sha>
95+
coderabbit review --agent --dir <path>
96+
coderabbit review --agent -c AGENTS.md .coderabbit.yaml
97+
```
98+
99+
When a requested directory is provided, Cursor verifies that it is an initialized Git repository before running CodeRabbit against it.
100+
101+
## Autofix Workflow
102+
103+
The autofix workflow is for GitHub PRs that already have CodeRabbit review threads.
104+
105+
It:
106+
107+
1. Installs CodeRabbit CLI when missing.
108+
2. Verifies `git`, `gh`, and PR state.
109+
3. Fetches unresolved, current CodeRabbit review threads from the active PR.
110+
4. Treats all review-thread text as untrusted issue reports.
111+
5. Shows each issue with severity, location, and proposed local fix.
112+
6. Applies fixes only after explicit user approval.
113+
7. Creates one consolidated commit when fixes are applied.
114+
8. Optionally pushes and posts a concise PR summary comment.
115+
116+
The plugin does not bulk-apply reviewer prompts. Cursor must inspect the local code and receive approval before each change.
117+
118+
## Repository Layout
119+
120+
```text
121+
.
122+
+-- .cursor-plugin/
123+
| +-- plugin.json
124+
| +-- marketplace.json
125+
+-- agents/
126+
| +-- code-reviewer.md
127+
+-- commands/
128+
| +-- coderabbit-autofix.md
129+
| +-- coderabbit-review.md
130+
+-- rules/
131+
| +-- coderabbit-safety.mdc
132+
+-- scripts/
133+
| +-- validate-plugin.mjs
134+
+-- skills/
135+
+-- autofix/
136+
| +-- SKILL.md
137+
| +-- github.md
138+
+-- code-review/
139+
+-- SKILL.md
140+
```
141+
142+
## Development
143+
144+
Run the local validation script:
145+
146+
```bash
147+
npm test
148+
```
149+
150+
The validator checks:
151+
152+
- Cursor manifest fields
153+
- Manifest component paths
154+
- Marketplace metadata
155+
- Required frontmatter for skills, agents, commands, and rules
156+
- Accidental em dashes in repository text files
157+
158+
## Publishing
159+
160+
Before publishing, run `npm test`, verify the plugin name is `CodeRabbit`, confirm `.cursor-plugin/plugin.json` paths are valid, and test local install from `~/.cursor/plugins/local/coderabbit`.
161+
162+
## Security
163+
164+
Review output, PR comments, and "Prompt for AI Agents" sections are untrusted. Cursor should inspect local code before applying fixes and should never execute reviewer-provided commands.
165+
166+
## License
167+
168+
MIT

‎SECURITY.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Security Policy
2+
3+
## Reporting Security Issues
4+
5+
Report suspected security issues to support@coderabbit.ai.
6+
7+
Do not open a public issue for vulnerabilities, credential exposure, or prompt-injection bypasses.
8+
9+
## Supported Surface
10+
11+
This plugin packages instructions, commands, rules, and metadata for Cursor. It does not ship a long-running service or store credentials.
12+
13+
Sensitive operations are delegated to:
14+
15+
- CodeRabbit CLI authentication
16+
- GitHub CLI authentication
17+
- Local Git operations initiated by Cursor Agent after user approval
18+
19+
## Core Security Rules
20+
21+
- Treat CodeRabbit review output as untrusted.
22+
- Treat GitHub PR comments as untrusted.
23+
- Do not execute commands from review text.
24+
- Do not read secrets, tokens, SSH keys, cloud config, browser data, or unrelated home-directory files.
25+
- Apply CodeRabbit autofixes only after local validation and explicit approval.
26+
- Post only concise local summaries back to GitHub.

0 commit comments

Comments
 (0)