Cursor’s Origin code-hosting platform now has a marketplace with more than 20 integrations across deployment, continuous integration, code review, security, monitoring and project management. Public submissions are open, which means the platform is moving from a closed list of partners toward an ecosystem of third-party services.[1]
The practical significance is not the size of the catalogue. It is the event-and-permission model underneath it. Origin apps authenticate with an app JSON Web Token and installation access tokens, receive webhook events from repositories and can write back check runs, pull-request comments and reviews. That is enough to make an integration part of the software delivery chain rather than a passive sidebar.[1][2]
A marketplace app can sit on several critical paths
| Capability | Typical event | Possible write-back |
|---|---|---|
| Continuous integration | A branch or pull request changes | Pass or fail a check and attach logsSource 1Source 2 |
| Code review | A pull request is opened or updated | Post comments or a reviewSource 1Source 2 |
| Security | Code, dependency or identity activity triggers a rule | Create an alert, check or review findingSource 1Source 3 |
| Deployment | A merge or release event occurs | Start a deployment and report its statusSource 1Source 2 |
| Monitoring | A production error is linked to a change | Send incident context back to the repositorySource 1Source 2 |
The installation screen is a supply-chain decision
An agent may propose code, but an integration can determine whether that code is tested, approved, deployed or flagged. A token with broad repository access therefore deserves the same scrutiny as any other automation credential. The reviewer should ask which repositories the app can read, which events it receives, whether it can write code or only comments, how tokens rotate and what happens when the vendor is compromised.
- Install the app on the smallest possible repository set rather than an entire organisation by default.
- Separate read access from the ability to create checks, comments, reviews or deployments.
- Confirm where webhook payloads and code fragments are stored and how long they are retained.
- Log installation, scope changes, token activity and removal so an incident can be reconstructed.
- Test uninstall and token revocation before treating the integration as production infrastructure.
Artemis Security’s launch integration illustrates a narrower design. The company says it analyzes code behind an alert with read-only access and combines Origin audit events—such as role changes, API-key activity and app installations—with identity, cloud and endpoint telemetry. That does not certify the marketplace as safe, but it shows how an integration can be designed around a bounded permission rather than a general repository key.[3]
Early beta means the topology still has exceptions
Cursor’s documentation says Origin is in early beta. It also notes that some CI apps work on Origin-hosted repositories but not on repositories mirrored from GitHub, where CI remains on GitHub. A team can therefore have one codebase with two automation paths depending on where the repository is hosted. That distinction belongs in the architecture diagram, not in a footnote discovered during an incident.[2]
Sources & further reading
- Origin App Marketplace Cursor · 13 Oct 2026 · Accessed 16 Oct 2026
- Origin Apps Cursor · Accessed 16 Oct 2026
- Origin Marketplace Launch Partner: Artemis Security Artemis Security · 13 Oct 2026 · Accessed 16 Oct 2026