Cursor Bugbot: AI pull request review, setup, rules and pricing

Cursor Bugbot is Cursor's automated pull request reviewer: it reads each PR diff and leaves comments that explain bugs, security issues and code quality problems, with suggested fixes. It runs on every PR update once you connect a repository, and you can also start a review by commenting cursor review or bugbot run.

This guide covers setup, review triggers, rule files, the repository config file, Autofix, limits and pricing, based on Cursor's Bugbot documentation and Bugbot help page, read on 24 October 2026.

What does Cursor Bugbot do?

Cursor's docs put it simply: "Bugbot reviews pull requests and identifies bugs, security issues, and code quality problems." In practice it:

• Reviews automatically on each PR update.
• Reads existing top-level and inline PR comments, so it avoids repeating feedback and builds on earlier reviews.
• Adds Fix in Cursor links that open an issue in the editor, and Fix in Web links that open it at cursor.com/agents.
• Writes a PR summary, by default into the pull request description.
• Posts a status check for each run.

By default Bugbot reviews only what changed since its previous review. Turn off Incremental Review in Bugbot Automations if you want the full diff reviewed on every push.

How do you set up Bugbot?

Bugbot needs a paid plan that includes it. On current plans that means Premium and above, as the Cursor pricing guide explains; Plus does not include it.

1. Open the Cursor dashboard and go to the Integrations tab.
2. Connect your repository provider and follow its setup flow.
3. Open Bugbot in Automations to choose which repositories it reviews.

Supported providers are GitHub (including GitHub Enterprise Server), GitLab (including GitLab Self-Hosted), Bitbucket (including Bitbucket Data Center), Azure DevOps Services and Origin, Cursor's code hosting. On GitHub, connecting turns Bugbot on for the repositories you grant access to. On the other providers you turn it on per repository.

On a team, members who cannot change installation settings see Request access instead of a switch, which emails admins a one-click link to turn Bugbot on for that repository.

How do you trigger a Bugbot review?

Bugbot runs on its own when a PR is created or updated. To run it by hand, comment one of these on the PR:

cursor review
bugbot run

Adding verbose=true (for example cursor review verbose=true) makes Bugbot reply with detailed logs, a table of the rules it used and a request ID for support.

Personal settings let you change when it runs for your own PRs: only when mentioned, only once per PR, and, on Team and Enterprise, reviews on draft PRs.

How do you tell Bugbot what to check?

Bugbot has its own rule system, separate from Cursor rules. The docs state that project rules (*.mdc files in .cursor/rules/) "do not apply to Bugbot runs."

Project rules live in .cursor/BUGBOT.md files. The root file is always included, and nested files are added when the PR touches files below them:

project/
  .cursor/BUGBOT.md          # always included
  backend/
    .cursor/BUGBOT.md        # included when backend files change
  frontend/
    .cursor/BUGBOT.md        # included when frontend files change

Rules are plain instructions. One of the docs' examples flags eval() and exec() with a blocking bug titled "Dangerous dynamic execution." Others require tests for backend changes or flag TODO comments.

Bugbot also supports:

• Team rules: written by admins in Bugbot Automations and applied to every enabled repository.
• Learned rules: generated from your team's activity when PRs are merged or closed. You can teach one inline by commenting @cursor remember [fact]. Each learning run counts toward Bugbot usage like a review.
• Manual rules: per repository, with a name, content and optional glob paths such as src/components/**.

Each rule is cut off at 30,000 characters, and the combined rules for one review are capped at 100,000 characters. Required team rules win when the cap is hit.

What can you set in bugbot.yaml?

You can also configure Bugbot from a file in the repository. Bugbot reads .cursor/config/bugbot.yaml from the PR's base branch, so a PR cannot change how it reviews itself:

# .cursor/config/bugbot.yaml
version: 1

triggers:
  drafts: false
  frequency: everyPush # everyPush | oncePerPr

review:
  effort: default # low | default | high | smart
  smartPrompt: ""
  incremental: true

prSummary:
  mode: comment # disabled | description | comment
  riskScore: true

autofix:
  mode: disabled # disabled | newBranch | existingBranch

Every field is optional, and files over 64 KB are ignored. A PR author's personal overrides come first, then this file, then dashboard settings. The file can lower the Autofix mode set in the dashboard but cannot raise it.

Effort levels trade cost for depth. Low optimizes for cost, Default for speed and efficiency, and High spends more time reasoning, so it may find more bugs at higher cost. Smart picks a level from instructions you write. Effort levels are only available on usage-based Bugbot plans.

What is Bugbot Autofix?

Autofix starts a Cloud Agent to fix the bugs Bugbot finds, pushes the fix and comments on the PR with the result. The modes are:

Azure DevOps supports neither automatic mode. Autofix needs additional usage available (prepaid credit, or on-demand usage on a legacy plan) and storage enabled, and it is billed as Cloud Agent usage at your plan rates.

Can you run Bugbot before you open a PR?

Yes. The /review-bugbot and /review skills run Bugbot from the agent before you push, in Cursor 3.7 and later, at cursor.com/agents and in the Cursor CLI. By default /review-bugbot reviews all changes on your branch against the base branch.

Cursor stores the patch ID of the reviewed diff. When you then open a PR with the same diff, Bugbot on GitHub, GitLab or Bitbucket recognizes it, skips the duplicate review and leaves a comment saying so.

Cursor also has a separate local feature, Agent Review, triggered with /agent-review, which reads the same BUGBOT.md rule files.

How much does Cursor Bugbot cost?

Bugbot uses usage-based billing after the May 2026 pricing update. Cursor's billing help page says: "The average Bugbot run costs between $1.00 and $1.50, depending on PR size and complexity." (As of October 2026.)

• Individuals: reviews use included usage first, then prepaid credit (or on-demand spend on a legacy plan).
• Teams: reviews are billed from the team's prepaid credit (or on-demand spend on a legacy Teams plan).

Each review is billed once, to the account or team that has Bugbot on for the repository. Teams that still have the old seat-based Bugbot plan can see the legacy pricing page linked from the docs.

What are Bugbot's limits?

• PR size: Bugbot skips PRs above its default size limit and asks you to split the change. Skipped runs record no review usage.
• Generated files: files marked linguist-generated in .gitattributes are left out.
• Bot-authored PRs: reviews of PRs opened by bot accounts are capped per team, and every review counts.
• Credential files: Bugbot does not read the contents of files like .env, id_rsa, *.pem, credentials.json or *.tfvars. Templates such as .env.example are reviewed normally.
• Merges: findings default to a neutral check conclusion, so a required check alone does not block merges.

Keep your review checklist in one place

A good BUGBOT.md usually starts as a review checklist you already use elsewhere, in a prompt or a code review skill. If you keep prompts and Agent Skills as Markdown in a GitHub repo, Kipt gives you a searchable library over that repo, so the same checklist is easy to find when you write Bugbot rules or a code review prompt.