Home / Guides / Cursor

Cursor code review in GitHub Actions

Updated July 4, 2026 · applies to pgup-ai/jbot-review-action v0

Your Cursor subscription can double as a PR reviewer. J-Bot Review is an MIT-licensed GitHub Action that runs the Cursor CLI inside your own CI. Setup is one API key from the Cursor dashboard and one workflow file; after that, every pull request gets verified, diff-anchored findings. Cursor stays in read-only plan mode the whole time, and J-Bot adds nothing to the bill.

Setup in three steps

1. Add the secret. Create an API key in the Cursor dashboard under Integrations (keys look like crsr_…) and save it as the repository secret CURSOR_API_KEY (Settings → Secrets and variables → Actions).
2. Commit the workflow. Add the file below as .github/workflows/jbot-review.yml.
3. Open a pull request. The Cursor CLI reviews the full base…head diff on your runner and posts review comments with a verdict; blocking findings are adversarially verified first, nits demoted.

name: J-Bot Code Review
on:
  pull_request: { types: [opened, reopened, ready_for_review, synchronize] }

concurrency:
  group: jbot-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  issues: write        # PR reactions use the issues API
  checks: read

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - uses: pgup-ai/jbot-review-action@v0
        with:
          provider: cursor
          cursor-api-key: ${{ secrets.CURSOR_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

What the review covers

• Your Cursor rules come along. The reviewer picks up the same rules files your editor already uses, plus AGENTS.md, REVIEW.md, .coderabbit.yaml, and greptile.json.
• The whole diff, base…head, with read-only checkout access for context (cursor-agent --mode plan).
• PRs that touch an external API or SDK get a Context7 check against current docs.
• Blocking findings are re-litigated in a second session before anything posts. What can't be defended gets dropped or demoted to advisory.

Cost & privacy

• Reviews bill to the Cursor plan you already have. J-Bot charges nothing; CI minutes are the only extra.
• The diff goes to Cursor's backend and nowhere else — the same vendor your editor talks to all day. There's no reviewer service in the middle.
• CURSOR_API_KEY belongs in Actions secrets, not variables. GitHub strips secrets from fork PRs, so outside contributors can't spend your seat. Worth a skim of your plan's terms on CI use, too.
• Doc-only PRs skip the model call entirely.

FAQ

Related