Codity Cursor Plugin

The Codity Cursor plugin brings Codity review, security scanning, PR triage, and fix workflows into Cursor's Agent.

It ships the same four Agent Skills as the Claude Code plugin, from the same repository. The skills drive the Codity CLI, so install and authenticate the CLI before using them.

Install

From the repository (any plan)

1. Open Customize in the sidebar.
2. Choose From GitHub Repository.
3. Paste https://github.com/codity-ai/codity-plugin.
4. Install the codity plugin.

This works on any Cursor plan. It relies on the .cursor-plugin/marketplace.json at the repository root.

As a team marketplace (Teams and Enterprise)

To distribute Codity centrally to an organisation instead:

1. Go to Dashboard -> Plugins & MCPs.
2. Under Team Marketplaces, choose Add Marketplace, then Import from Repo.
3. Paste the same repository URL, then install from Customize.

Turn on Enable Auto Refresh if you want new skill versions to arrive automatically. Team marketplaces arrived in Cursor 2.6 and require a Teams or Enterprise plan, which is why the personal flow above is the default here.

From the CLI

If you would rather not use a marketplace, the CLI writes the skills straight into Cursor's skills directory:

codity skill install --editor cursor            # ./.cursor/skills/ in this project
codity skill install --editor cursor --global   # ~/.cursor/skills/ for every project

Existing files are kept unless you pass --force. Reload the Cursor window afterwards. The command works without a login and outside a git repository, and --json prints the files it wrote.

Authenticate the CLI

Run this in your own terminal, not through the agent: it needs a real terminal and opens a browser.

codity login

For Codity email accounts, use codity login --email.

Skills

Agent picks a skill automatically when a request matches its description, for example "review my changes with Codity", "fix the Codity comments", or "is my PR ready". That is the path we test. Typing /code-review, /autofix, /check-pr or /codity-loop may also work depending on your Cursor version; Cursor documents disable-model-invocation: true as the setting that turns a skill into a pure slash command, and these skills deliberately leave it off so they can trigger from natural language.

The plugin ships skills only. The Claude Code plugin's /codity:* slash commands are not part of the Cursor install, because Cursor expresses the same workflows as skills.

One consequence: Claude Code's /codity:scan has no Cursor equivalent, because it is a command rather than a skill. To scan in Cursor, ask for a full review ("run a security review of my staged changes with Codity"). The code-review skill uses --full, so the SAST, SCA and licence findings come back in the same result.

Typical Workflows

Review Local Changes

1. Make changes in your repository.
2. Ask Agent to review them with Codity, or type /code-review.
3. Review the findings, grouped critical to low.
4. Approve the fixes you want applied.

Fix Existing PR Comments

1. Open the repository for the PR in Cursor.
2. Type /autofix.
3. Approve or skip each proposed fix.
4. Resolve the addressed threads in your provider's UI. Codity's CLI does not resolve threads.

Check Whether a PR Is Ready

Type /check-pr. Agent gathers CI status, review comments, and Codity findings, then reports what still needs attention before merge. This workflow never modifies code.

Iterate Until Clean

Type /codity-loop. Codity reviews, fixes actionable findings, and re-reviews in a loop until no critical or high issues remain, up to a maximum of 5 iterations.

How the Skills Call the CLI

Every skill follows one shared contract, which matters if you are debugging what Agent ran:

• Commands are prefixed with CODITY_NO_TTY=1. Without it, codity opens its full-screen terminal UI whenever the agent's shell looks like a terminal, and the session hangs.
• --json is supported by review, usage and skill install. scan, risk-analysis, test-gen and pr comments print text, so security findings are read from the security object of codity review --full --json.
• Neither the exit code nor counts is a verdict. codity review exits 0 even with critical findings, and counts summarises the comments array alone, so it can read 0 while security.findings holds a critical issue. Pass and fail are judged from comments, security.findings and quality.findings together.
• Commands that block on a terminal prompt are never run by a skill: login, init, debug, context generate, config set-pat, config set-llm, and pr resolve. Agent asks you to run those yourself.

Requirements

• Cursor 2.4 or later for codity skill install --editor cursor, which writes plain skill files and needs nothing newer.
• A recent Cursor for the plugin install; team marketplaces specifically need 2.6 and a Teams or Enterprise plan.
• Codity CLI installed and available on PATH.
• An authenticated Codity CLI session.
• Repository access for the PR or local changes you want reviewed.
• GitHub or GitLab CLI tools are useful for detecting the current PR number and resolving threads, but Codity talks to supported providers directly for comments.

Troubleshooting

If a skill does not appear:

• Confirm your Cursor version. Skills need 2.4; the plugin install flows need a newer build, and team marketplaces need 2.6. If you cannot find the install screen, use codity skill install --editor cursor instead, which works on 2.4.
• Open Customize -> Skills and check that the four Codity skills are listed and enabled.
• If you installed with codity skill install, reload the window, and check that the files exist under .cursor/skills/ or ~/.cursor/skills/.

If a skill runs but the CLI fails:

• Run codity --version to confirm the CLI is installed.
• Run codity doctor to check service connectivity.
• Run codity login or codity login --email if authentication expired.
• Open the repository you want reviewed as the Cursor workspace root, since the CLI must run inside the target git repository.