Cursor Origin Integration

Overview

The Cursor Origin integration connects your Origin codebase to Fencer. It enables repository discovery, automatic code scanning on push and pull request events, scan results reported as check runs on the pull request, AI security reviews, and automated fix pull requests.

Unlike the GitHub integration — where you install a single Fencer-published app — Cursor Origin only supports apps that belong to one team. There is no shared app to install, so each organization registers its own Origin app for Fencer and hands Fencer the App ID plus a signing key. Fencer’s connect wizard generates the key pair for you and walks you through the Create App form field by field.

Prerequisites

An active Fencer organization with a valid subscription.
Admin role in your Fencer organization.
Permission to create an app in your Origin codebase settings (cursor.com/codebase/settings/apps) and to approve its installation.

How it works

Fencer authenticates to Origin’s partner API with two credentials. App-level calls (reading app metadata, listing installations, minting tokens) use a short-lived JWT signed with the Ed25519 private key Fencer generated for you — Cursor only ever holds the public half. Repository-level calls use an installation access token, which Origin caps at fifteen minutes, so Fencer mints one just in time for each operation.

Origin registers one webhook URL per app rather than per repository, so a single Fencer endpoint receives every delivery for your app. Fencer verifies Origin’s signature, routes the delivery to your organization by App ID, and matches the repository in the payload against your tracked repositories. Deliveries are deduplicated by their delivery id, so Origin’s at-least-once retries never trigger a duplicate scan.

Scan and review results come back to Origin as check runs. The code scan is reported in a suite named Fencer; the AI security review is reported in a separate suite named Fencer AI security review, so triggering a review never replaces the scan results.

Usage / Configuration

Creating your Origin app

Navigate to Settings > Integration Settings in your Fencer organization.
Find Cursor Origin (Code) and click Connect.
Fencer generates an Ed25519 key pair as the page loads and keeps the private half encrypted. The wizard then lists every field of Origin’s Create App form with a copy button.
Click Open the Create App form and fill it in with the values Fencer shows. Leave anything the wizard does not mention at its default:
- App Name, Description, Website URL — suggested values you can change.
- Webhook URL — must match exactly. This is where Origin sends push, pull request, and installation events.
- Webhook Events — tick the events the wizard lists (see below). A missing event silently means the corresponding automation never runs.
- Installation Redirect URIs — the single URI the wizard shows. Origin returns here after you approve the install.
- Default App Permissions — tick the permissions the wizard lists under the Repository scope.
- Slug — lowercase letters, digits, and hyphens. Origin does not allow changing it after the app is created, and Fencer suggests one that includes your organization so it will not collide with another team’s app.
- Public Key (PEM) — paste the whole block Fencer shows, including the BEGIN and END lines.
Select Create App, then copy the App ID (app_01…) from the app’s page.
Back in Fencer, paste the App ID into the next step and submit. Fencer validates the App ID against the generated key before saving anything, so a typo costs you nothing but a retry. You then land on the connection page. If the app isn’t installed into a codebase yet, continue with Installing the app into your codebase below.

Webhook events Fencer needs

Event	What it drives
`repository.pushed`	Code scans on pushed branches
`pull_request.created`	Pull request scans and AI reviews
`pull_request.head_ref.pushed`	Re-scan when a pull request gets a new head
`pull_request.published`	Scans and reviews when a draft is published
`pull_request.reopened`	Scans and reviews on reopen
`pull_request.merged`	Marks a merged Fencer fix as ready for verification
`pull_request.closed`	Marks a rejected Fencer fix
`pull_request.comment.created`	Detects the `/fencer review` reply that confirms a review

installation.created and installation.deleted are always sent by Origin and cannot be unticked; Fencer uses them to keep your installation state in sync.

Permissions Fencer requests

Read repository metadata (required, and already ticked by Origin)
Read repository contents, branches, and commits — cloning for scans, listing commit authors
Read pull requests and changed files — assembling the review diff
Read pull request comments and reviews — reconciling the confirmation reply
Write repository contents and branches — pushing the branch for an automated fix
Create and update pull requests — opening the fix pull request
Create pull request comments and reviews — posting AI review comments
Create and update check suites and runs — reporting scan and review status

Fencer deliberately does not request Read check suites and runs: nothing reads check state back.

Installing the app into your codebase

Creating an app is not the same as installing it. If you already installed the app into your codebase before connecting, Fencer adopts that installation automatically and you are done. Otherwise the connection page shows This app isn’t installed into a codebase yet:

Click Install on Cursor Origin.
Approve the installation and choose whether to grant all repositories or only selected ones.
Origin redirects you back to Fencer, which reads the installation’s target codebase and approved scopes.

Adding repositories

Go to Settings > Integration Settings and click Edit on your Cursor Origin connection.
Under Add repositories, search the repositories the installation can reach.
Click Add. Fencer creates the repository asset and triggers an initial code scan.

Only native Cursor repositories can be added here. Origin does not grant apps access to repositories that are synced in from GitHub — add those through the GitHub integration instead.

Only repositories granted to the installation appear here. To widen the list, change the repository selection on the installation in Origin — Fencer picks the change up from the installation event.

Managing connected repositories

From the same page, each connected repository can be:

Marked in scope or out of scope (see Asset Scope Management).
Suspended, which stops webhook-triggered scans without removing the repository.
Removed, which soft-deletes the repository asset. Fencer keeps historical scan results.

Code scanning on push and pull requests

Scans are triggered automatically from webhook deliveries:

Pushes — every branch tip a push moved is scanned. A single push can move several branches, and each one gets its own scan. Branch deletions and tags are skipped.
Pull requests — opened, reopened, published from draft, or pushed to. Fencer scans the head commit of the source branch.

Scan configuration is set per repository from the repository detail page, the same as every other provider. See Code Scanning.

Check runs

Fencer reports scan progress as a check run named Fencer Security Scan in the Fencer check suite, on the scanned commit. The run moves through:

Queued — scan is queued.
In progress — scan is running.
Completed — with a conclusion of success (no new vulnerabilities above your thresholds) or failure. Cancelled and timed-out scans complete with those conclusions instead.

Origin’s Checks API has no line annotations, so findings that would be inline annotations on other providers are written into the check run’s body as a list of path:line entries linking back to the finding in Fencer. The list is capped at 50 findings, with a pointer to the full scan for the rest. Disable it by turning off Annotations in the repository’s scan configuration.

AI PR reviews

AI PR Reviews work on Origin pull requests, with two differences:

Confirmation is a comment, not a checkbox. Reply /fencer review to Fencer’s invitation comment. Origin has no checkbox support.
Findings are not line-anchored. Origin’s comment API is general-discussion only, so every finding is rendered into the summary comment with a path:line prefix instead of posted inline.

Review lifecycle is reported as a Fencer AI security review check run in its own check suite, so a review in progress or completed shows on the pull request’s Checks tab alongside the code scan.

Automated fix pull requests

Automated Remediation opens fix pull requests on Origin repositories. Because Origin’s API is read-only for repository contents, Fencer pushes the fix branch over authenticated HTTPS and then opens the pull request. Re-running a fix targets the same branch and force-pushes over it.

When you merge a fix pull request, the vulnerability moves to Ready for verification. When you close it without merging, the fix attempt is recorded as rejected.

Disconnecting

Go to Settings > Integration Settings and find your Cursor Origin connection.
Delete the connection. Fencer stops processing deliveries and soft-deletes the associated repositories.
Uninstall the app in Origin, or delete it entirely, if you no longer want Fencer to hold credentials for it.

Supported features

Feature	Supported
Repository discovery	Yes
Code scanning on push	Yes
Code scanning on pull requests	Yes
Status reporting	Yes, as check runs
Inline annotations on findings	No — rendered in the check run body
AI PR reviews	Yes, confirmed with `/fencer review`
Inline AI review comments	No — collected in the summary comment
AI review check status	Yes
Automated fix pull requests	Yes
Contributor counting from commit authors	Yes
Identity sync	No

Identity sync is unavailable because Origin’s partner API exposes repositories, commits, checks, and pull requests, but no workspace-member listing — there is nothing to sync identities from. Use Identity Management with your identity provider instead.

Examples

Typical workflow with a pull request

A developer opens a pull request on a connected Origin repository.
Origin delivers pull_request.created; Fencer queues a code scan and posts a Fencer Security Scan check run in the queued state.
The scan runs. The check run moves to in progress, then completes as success or failure, with findings listed in its body.
In parallel, Fencer posts an AI review invitation comment. The developer replies /fencer review, and the review posts its findings as a summary comment with a Fencer AI security review check run.
The developer pushes a fix. pull_request.head_ref.pushed re-scans the new head and the check runs update in place rather than stacking up.

Connecting a codebase you already installed the app into

Create the app in Origin and install it into your codebase in the same sitting.
In Fencer, run the connect wizard and paste the App ID.
Fencer validates the credentials, finds the app’s single existing installation, and adopts it — no second consent round-trip.
Add repositories and Fencer starts scanning.

Troubleshooting

“Cursor Origin rejected these credentials” — The App ID does not match the key Fencer holds. Confirm you copied the App ID (app_01…) from the app you registered the generated public key on. If you created several apps, make sure you are using the right one.
“This Origin App is already connected to another Fencer organization” — Origin webhooks are signed by Origin rather than by your app, so Fencer routes deliveries by App ID alone and an App ID can only belong to one organization. Disconnect it in the other organization, or create a separate Origin app for this one.
“The generated signing key is no longer available” — The key from your wizard session is gone. Restart the connect flow, register the new public key on the app (replacing the old one), and try again.
Connected but no repositories to add — The app is not installed into a codebase, or the installation grants no repositories. Use the Install on Cursor Origin link on the connection page, or widen the repository selection on the installation.
A repository is missing from the picker — Origin does not grant app access to repositories it mirrors in from GitHub. Connect those through the GitHub Integration instead.
Nothing happens on push or pull request — Check the app’s webhook events in Origin against the list above; the wizard’s event list is the exact set Fencer acts on. Also confirm the webhook URL matches the one shown on the connection page.
Integration turns “Broken” — Either the app’s signing key is no longer registered, or the app was uninstalled from the codebase. Origin’s installation.deleted event marks the connection broken immediately. Re-install the app, or re-check the key.
A fix pull request cannot be merged — Repositories that Origin mirrors out to GitHub reject merges from within Origin. Merge on the GitHub side instead.