New: Pressure test your SOC 2 report against buyer requirements
Free check
Cursor recently shipped Origin, its own git hosting. Fencer now scans Origin pull requests with SAST, AI review, AI triage, and autofix PRs. Available to all customers today.
Agents generate more code per engineer than any review process was designed for, and someone has to read it with an adversarial eye before it reaches production. That job doesn't care which git host the pull request lives on.
That's why we built Fencer's Cursor Origin integration, which is now available to every customer. The integration brings SAST, AI PR security reviews, vulnerability triage, and automated fix PRs to Origin — the same pipeline we already run on GitHub, GitLab, Bitbucket, and Azure DevOps.
Origin is Cursor's own git hosting: real repository storage with pull requests, check runs, and an app platform on top, rather than a wrapper around someone else's forge. Their engineering write-up covers how they built it to scale. What makes it interesting is the editor sitting next to it. Cursor now owns the editor, the agents, and the git host, so the round trip from working tree to branch to reviewed pull request is one system instead of three products bolted together. Most forges were designed for humans reviewing humans; what actually happens now is a few humans reviewing a lot of agent output, with agents doing some of the review too. Origin is still an Early Beta, but it's a credible base for somewhere programmers and their agents can work together.
Origin repositories get the full Fencer code security pipeline, which was built to help secure your AI slop.
SAST on every push and pull request. Deterministic scanners run against the diff and report through Origin's check runs. Agents reproduce whatever pattern is in their context window, so when one writes an unparameterized query it tends to write forty.
AI pull request review. A model reads the diff in context and flags what scanners structurally can't see, like a new endpoint that skipped the authorization check every sibling endpoint has. Agent code is fluent and well-formatted, which is what makes those omissions easy to skim past. Trigger it with a /fencer review comment.
AI vulnerability triage. Every finding is classified for exploitability before it reaches a human, using the multi-vote approach we benchmarked across 15 models. A recall-tuned scanner against an agent-sized diff buries the real findings in noise, and a queue nobody opens is the same as no scanner.
Automated fix pull requests. Confirmed findings get a fix PR opened back into Origin with the patch and the reasoning. Code written in a minute shouldn't wait a sprint for a two-line fix.
Setup steps are in the Cursor Origin integration docs.
On GitHub, Fencer is one app you install in a click. On Origin, each organization registers its own app: Fencer generates an Ed25519 key pair and shows the exact values for Origin's Create App form, and you paste the resulting App ID back. It works, and we've made it as mechanical as we can, but it's form-filling instead of a button.
That's an Early Beta gap rather than a design choice. The multi-tenant model, where one vendor-owned app installs into many customer workspaces, isn't something integrators can enable yet. We've raised it with Cursor and they've taken the request on board, and we're in conversation with them about becoming a listed integration alongside the ones already in Origin's catalog. No dates promised, theirs or ours, but the direction is clear.
Fittingly, we built a good chunk of this integration with Cursor's own agents — their models and harness helped ship support for their git host.
The integration is available to all Fencer customers now. Connect an Origin codebase from Integration Settings, or read the docs first.
