If your repositories live in Cursor, every pull request can now get a Semgrep security check. Findings land as checks and comments right in the workflow you already use, with no separate tool to set up after the fact. As more teams host their repositories inside Cursor itself, security has to be there too - not bolted on downstream, in a separate tool, after the fact. Cursor Origin makes that possible from day one.
"As more enterprise teams adopt AI-assisted development, they need confidence that speed isn’t coming at the cost of security posture. One of the reasons we collaborated with Semgrep is to continue to provide customers with that assurance out of the box."
Tomas Reimers, Product & Engineering, SpaceXAI
"Agents can write code around the clock, but they need guardrails to produce secure code. Bringing Semgrep into Origin gives agents security feedback they can act on as they work, so teams can increase velocity with confidence in what they ship."
Daghan Altas, Head of Product, Semgrep
How Semgrep Works in Origin #
Origin connects your repositories to Semgrep and keeps them scanned automatically. Here's what's possible on day one:
- Repository sync, automatically. Connect once, and Origin keeps your repositories synced with Semgrep - no manual re-linking, no scripts to maintain.
- Scans on every pull request. Every PR triggers a Semgrep Managed Scan coveringSemgrep Code (vulnerabilities in your first-party code),Semgrep Supply Chain (risky dependencies), andSemgrep Secrets (exposed credentials). Results post as checks and comments right where the review is already happening.
- Simple install . Easily install Semgrep from inside your Origin Codebase Settings with the Semgrep app - available in the Origin marketplace.
Connecting Semgrep to Origin #
Semgrep in Origin is available now in beta. You can connect from either side:
- From Semgrep: go to [__Settings → Source Code Managers → Connect → Origin__](https://semgrep.dev/orgs/-/settings/source-code) .
- From Cursor: [__install the Semgrep app__](https://cursor.com/codebase/settings/apps) from Codebase Settings.
Either way, your repositories sync and every pull request gets scanned.
Teams that need a dedicated app identity and control over their own signing-key lifecycle can set up a private app instead. Contact us to get started.