Cursor releases its Agent SDK
Cursor has made generally available the framework behind its own Bugbot and Security Reviewer agents, so teams can write custom agents in code and deploy them to Cursor's infrastructure with a single command.
Cursor announced the general availability of its Agent SDK. The framework is the same one the company uses to build its own managed agents: Bugbot, Security Reviewer and Rollouts.
Each agent is set up like a small software project. Prompts are written in Markdown and tools are defined as TypeScript functions. Connections to outside services and evals sit in the same project, so changes can go through normal version control and code review. Developers can start from a template or point a coding agent at Cursor's docs, which come with skills that walk agents through the build. According to Cursor's changelog, the starter templates are a security reviewer, an owners-policy approver, a PR autofixer and a Linear or Jira triager. A local playground is available for testing.
Agents respond to events. In Cursor's code-review example, an agent picks up pull request events from GitHub, GitLab or Bitbucket, assesses the risk of the change, routes it to the right team and approves changes that meet a set policy. Besides pull request, comment and CI events from those platforms, agents can also be triggered by Slack mentions and DMs, webhooks from any provider and a cron schedule, the changelog says. GitHub events come through the user's Cursor account, so no public webhook URL is needed. Agents can hand tasks to specialized agents with their own tools and sessions, or split a job among subagents working in parallel. The SDK also has built-in evals and event replay.
Running agent-sdk deploy builds the agent, gives it a URL and starts it on Cursor's infrastructure. Secrets and integrations are managed from a dashboard. Teams that want to host agents themselves can run each one as a single Node process packaged in a container.
Cursor said one internal team built "kb-reviewer" in about a day. It checks every PR against a knowledge base of lessons learned and cites the note behind each finding. The PGA Tour uses the SDK to run what it calls its "software development factory" and credits the built-in evals with letting it iterate quickly.
Cursor did not disclose pricing for hosted deployment.
Sources
Updates
- Added the extra agent triggers (Slack, webhooks, cron) and the list of starter templates from Cursor's changelog