Agent SDK

Appearance

Review pull requests with owners policies ​

This agent reviews every pull request in your repository. It risk-tiers the diff, requests the owning team or user as reviewers, and approves what your policy allows. Ownership rules live in .agentic-owners/policy.yml files committed at any depth of the repo; the closest policy to a changed file wins, and policies are always read from the PR's base ref so a PR cannot exempt itself.

Scaffold ​

bash
npx @cursor/july init ./owners-agent --template agentic-owners

init writes the project, installs dependencies, and puts agent-sdk on PATH.

Log in and run ​

Set your repositories in agent/lib/config.ts (repos: ["you/your-repo"]), then:

bash
cd owners-agent
agent-sdk login
agent-sdk dev

PR events stream through your Cursor account — no webhook or GitHub App setup. Open a PR, or replay a real one deterministically (this also works with repos empty):

bash
agent-sdk github replay https://github.com/you/your-repo/pull/123 --dir .

Deploy with agent-sdk deploy.

Policies ​

With no policy files, every PR gets a default risk review: very-low and low risk approve, medium and above hold with a comment. Route reviews by committing policies:

yaml
# .agentic-owners/policy.yml — anywhere in the repo; closest wins.
# paths are repo-root-relative globs, wherever the policy file lives.
version: 1
policies:
  - paths: ["docs/**"]
    always_approve: true
  - paths: ["src/api/**"]
    team: acme/platform # or user: alice
    prompt: api-review.md # optional extra rubric, same directory
  - paths: ["src/billing/**"]
    user: alice
    human_review_required: true # the agent never approves; a person must

self_review: true lets a listed owner's own PRs clear their rule. global_exclusions in the root policy opts paths out entirely.

What one review does ​

One model turn per PR head assesses the host-fetched diff against the base rubric plus any matched rule prompts, then records a verdict with record_review. The host recomputes the policy from trusted state and applies the deterministic decision:

  • Approve when the tier is low and no matched rule demands a human, bound to the head SHA.
  • Request reviewers otherwise — the policy owners (max 2, never the author), plus one status comment the agent keeps updated in place.

The model never writes to GitHub. A broken policy file fails closed with a comment listing the validation issues.

Rubric ​

Edit agent/lib/owners/prompts/base-review.md for the risk tiers and their boundaries. Per-area guidance belongs in policy prompt: files next to the policy that names them. The next review reads both.

Evals ​

bash
agent-sdk eval

Three smoke reviews (docs-only, auth deletion, prompt injection). Eval sessions skip GitHub writes.