GReviewer
Runs on your Cursor subscription

PR reviews from the Cursor plan you already pay for

GReviewer runs Cursor Cloud Agents on your pull requests, applies the rules you wrote, and posts structured comments on GitHub. No second model bill.

Install the GitHub App, paste a Cursor API key, enable one repository. A review takes two to five minutes.

acme/api src/auth.ts:12

securityBlocking

The session cookie is set without HttpOnly, so any script on the page can read it. The same cookie is the only thing guarding the admin routes.

11const token = await createSession(user.id)12-cookies().set("session", token)12+cookies().set("session", token, { httpOnly: true, sameSite: "lax" })

Posted as an inline comment on acme/api#284. Security is a blocking category here, so the GReviewer check fails until this is resolved or dismissed.

How it works

  1. 1

    Connect GitHub and Cursor

    Install the GitHub App on the repositories you pick. Paste a Cursor API key. GReviewer encrypts it with AES-GCM and never shows it again.

  2. 2

    Open a pull request

    On open, push, ready for review, or a /review comment, a Cursor Cloud Agent reads the diff along with the callers and tests around it. Each repository chooses its own triggers.

  3. 3

    Read the findings on GitHub

    One summary comment plus inline comments carrying severity, category, and a suggestion you can commit. Blocking categories fail the GReviewer check. Everything else stays a comment.

Tune the reviewer, then work the queue

A generic reviewer gets ignored by the second week. GReviewer gives you the rules, the policy, and the numbers to keep it worth reading.

Rules the agent actually follows
Write each rule as an instruction to a careful reviewer. Say what to flag, what to leave alone, which paths it covers, and how loud it should be. A workspace baseline applies everywhere and the playbook attached to a repository wins any conflict. Start from a template or import the AGENTS.md you already keep.

No secrets in client components

app/**

Blocking

Server-only imports stay server-only

src/**

Should fix

Prefer the shared logger

lib/**

Nit
Nothing posts until you say so
Set a repository to approval mode. The review still runs, then the comments wait in the dashboard until you click Post to GitHub. Your Cursor key is encrypted at rest and only decrypted while a job runs.
One policy per repository
Pick the triggers, the categories that block merge, the paths to skip, and the reviewers to request when a finding blocks.
  • Pull requests to main
  • A /review comment
  • Pushes on other pull requests
Every run lands in one queue
Reviews sort into needs action, running, and cleared today. Assign a finding, dismiss a false positive with a reason, re-review after a push, or compare two runs on the same pull request to see what closed and what is still open.

Needs action

2

Rotate session cookies on login

acme/api #284

Blocking

Move checkout to the app router

acme/web #1192

Should fix
Learn which rules earn their keep
Insights track reviews completed, blocking findings fixed, and median time to first review. Recurring issues splits your rules into the ones reviewers confirm and the ones they keep dismissing as noise, so you can downgrade a rule to a nit or turn it off.
CI sits next to the findings
GReviewer syncs GitHub Actions runs from enabled repositories. The job that failed shows up on the review page, down to the step, so you are not switching tabs to work out why the branch is red.

Questions

Ready when you are

Connect Cursor, enable one repository, and the next pull request gets a review.