Skip to content
Agentdex
Get the free pack

Blog · · Agentdex Editorial

Cursor Code Review: How Bugbot and In-Editor Reviews Work (2026)

Cursor (Agentdex profile) can review code in two places: inside the editor before you push, and on your pull requests through Bugbot, its automated PR reviewer. Used together, they catch a lot of the bugs AI-written code tends to introduce, without replacing human judgment on what should merge. This guide covers how both work as of October 24, 2026, how to configure them with rules, what it costs, and where to slow down.

Key Takeaways

  • Bugbot reviews pull requests on GitHub, GitLab, Bitbucket, Azure DevOps and Cursor's Origin, and leaves comments with explanations and fix suggestions.
  • You can run the same review locally with the /review-bugbot or /review skills before you push (Cursor 3.7+, cursor.com/agents and the CLI).
  • Guide reviews with .cursor/BUGBOT.md files. Regular Cursor project rules in .cursor/rules/ do not apply to Bugbot.
  • AI code reviews through Bugbot are included from Cursor's Premium plan ($30/month), with usage-based billing beyond your included usage.
  • Treat AI review as a first pass. A human should still approve auth, payments, data migrations and anything security-sensitive.
A developer reviewing code on a wide monitor

Why AI code review matters now

More code is now written with AI help, and review is where problems get caught. In December 2025, CodeRabbit published a report analyzing 470 open-source GitHub pull requests: 320 it identified as AI-co-authored and 150 it classified as human-only. The AI-co-authored PRs averaged 10.83 issues each versus 6.45 for the human-only ones, about 1.7 times as many, with roughly 1.4 to 1.7 times as many critical and major findings. Two caveats: CodeRabbit sells an AI review tool, and it could not confirm that the "human-only" PRs had no AI help. The direction still matches what many teams report: AI speeds up output and increases what reviewers need to check.

Reviewing in the editor before you push

The cheapest bug to fix is the one you catch before opening a PR. In Cursor you can:

  • Run /review-bugbot: by default it reviews every change on your branch relative to the base branch, including uncommitted work. Ask it to review only uncommitted changes for narrower feedback, or tell it which base branch to compare against.
  • Ask the agent targeted questions: what calls this function now, what happens if this request fails, which edge cases are untested, and whether similar code elsewhere in the repo handles errors differently.
  • Keep diffs small: focused commits get more precise reviews than sprawling ones.

A useful bonus: /review-bugbot stores a patch ID for the diff it reviewed. If you then open a PR with the same diff, Bugbot on GitHub, GitLab or Bitbucket recognizes it and skips a duplicate review.

How Bugbot reviews pull requests

Connect your repositories in the Cursor dashboard, then manage Bugbot under Automations. Bugbot analyzes the PR diff and comments with explanations and suggested fixes. Key behaviors from Cursor's docs:

  • Triggers: it runs on every PR update by default, or on demand when someone comments cursor review or bugbot run. You can limit it to once per PR or to mentions only.
  • Incremental reviews: by default it reviews only changes since its last review.
  • Context: it reads existing PR comments to avoid duplicate suggestions.
  • Limits: it skips PRs above its size limit and asks you to split them, ignores files marked linguist-generated, and does not read credential files such as .env or key files.
  • Fixes: "Fix in Cursor" and "Fix in Web" links open issues for you to fix. Optional Autofix spawns a cloud agent that pushes fixes to a new branch or your existing branch (capped at three attempts per PR).

One detail catches teams out: Bugbot's GitHub check (named Cursor Bugbot) reports findings as neutral by default. Requiring the check in branch protection ensures Bugbot runs, but does not block merges on findings unless fail-on-unresolved-issues is enabled for your organization.

Two developers reviewing code together at a workstation

Configuring Bugbot: rules and settings

BUGBOT.md rules. Create .cursor/BUGBOT.md at the repo root for project-wide guidance, and nested files (for example backend/.cursor/BUGBOT.md) for folder-specific rules; Bugbot includes those found while traversing upward from changed files. Good rules are concrete:

  • "Flag any new endpoint without tests for invalid input."
  • "Payment and auth code must not log tokens or card data."
  • "Flag new dependencies and ask for a justification."
  • "Database migrations must not drop columns without a deprecation step."

Team admins can add team rules that apply across repositories, and you can teach Bugbot inline by commenting @cursor remember [fact] on a PR. Learned rules can also be generated from your team's PR history. Each rule is truncated at 30,000 characters, and combined rules are capped at 100,000. Comment bugbot run verbose=true to see which rules a review used.

Repo config file. An optional .cursor/config/bugbot.yaml sets triggers (everyPush or oncePerPr), review effort (low, default, high or smart), PR summaries and Autofix mode. Bugbot reads it from the base branch, so a PR cannot change how it gets reviewed.

Remember that your editor rules in .cursor/rules/ guide the agent while it writes code, but do not apply to Bugbot. Put review standards in BUGBOT.md. Our Cursor rules guide covers the editor side.

What it costs

On Cursor's pricing page, AI code reviews through Bugbot are included on Premium ($30/month), Super ($100), Ultra ($200), Teams (from $30 per user per month) and Enterprise, but not on the Free or Plus ($8) plans. Bugbot uses usage-based billing: reviews draw on your included usage first, then on prepaid credit. Higher effort levels can find more bugs but use more usage, and Autofix is billed as cloud agent usage. Check Cursor's pricing page for current rates.

A sensible review workflow

  • Run /review-bugbot locally and fix what it finds before opening the PR.
  • Let Bugbot review the PR, and keep CI running linters, tests and secret scanning so the AI focuses on logic.
  • Have a human review anything touching auth, payments, data integrity or infrastructure.
  • Promote repeated human review comments into BUGBOT.md rules, and prune rules that only produce noise.
  • Start with Autofix off or on a new branch, and only loosen it once you trust its output.
A person inspecting a blueprint, like a careful manual code review

Limits and trade-offs

AI review is good at spotting missing error handling, risky patterns and inconsistencies with nearby code. It is weaker on business rules nobody wrote down, product decisions and system-level behavior. It can also produce comment fatigue if rules are vague. If you want a second opinion from a different vendor, GitHub Copilot (Agentdex profile) also reviews pull requests on GitHub. Whatever you use, keep the final merge decision with a person.

Model Pulse

Daily AI model drops, tools, and what they mean for AI coders.

FAQ

Does Cursor have built-in code review?

Yes. Bugbot reviews pull requests automatically, and the /review-bugbot and /review skills run reviews in the editor, at cursor.com/agents and in the Cursor CLI.

Is Bugbot free?

No. Cursor's pricing page lists AI code reviews via Bugbot on Premium ($30/month) and higher plans, plus Teams and Enterprise. Reviews draw on included usage first, then prepaid credit.

Do my .cursor/rules files apply to Bugbot?

No. Cursor's docs say project rules in .cursor/rules/ do not apply to Bugbot. Use .cursor/BUGBOT.md files, team rules and learned rules instead.

Which Git platforms does Bugbot support?

GitHub (including Enterprise Server), GitLab (including self-hosted), Bitbucket (including Data Center), Azure DevOps Services and Cursor's Origin.

Can Bugbot block a merge?

Only if configured to. Findings default to a neutral check status. Require the Cursor Bugbot check and enable fail-on-unresolved-issues, where available, to make unresolved findings fail the check.

Is AI-generated code riskier to merge?

Often, yes. CodeRabbit's December 2025 analysis of 470 open-source PRs found about 1.7 times as many issues in AI-co-authored PRs, though it could not confirm authorship for every PR. Review AI code at least as carefully as human code.

Related guides

Part of our Cursor guides hub

Written by Agentdex Editorial. Agentdex is an independent directory reviewing AI coding tools; we are not affiliated with the companies mentioned. Prices and features are as of October 24, 2026, from official sources linked above. Always confirm on the vendor's site.