Skip to content

cursor plugin support#255

Merged
khaliqgant merged 1 commit intomainfrom
cursor-plugins
Mar 17, 2026
Merged

cursor plugin support#255
khaliqgant merged 1 commit intomainfrom
cursor-plugins

Conversation

@khaliqgant
Copy link
Copy Markdown
Collaborator

@khaliqgant khaliqgant commented Feb 18, 2026

User description

https://cursor.com/docs/plugins/building


CodeAnt-AI Description

Add first-class support for Cursor plugins (.cursor-plugin/plugin.json)

What Changed

  • Recognize and install Cursor plugins as a new package subtype (discover .cursor-plugin/plugin.json and include .cursor-plugin/ in format listings)
  • Parse, validate, and convert Cursor plugin manifests to/from the canonical package format so plugin metadata, MCP servers, and component paths round-trip
  • Publish JSON Schema for Cursor plugin manifests and surface it in public docs and format registry; tests updated to reflect plugin capability changes

Impact

✅ Installable .cursor-plugin packages
✅ Schema validation for Cursor plugin manifests
✅ Round-trip conversion of Cursor plugins to canonical format

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Feb 18, 2026

CodeAnt AI is reviewing your PR.


Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@codeant-ai codeant-ai Bot added the size:XL This PR changes 500-999 lines, ignoring generated files label Feb 18, 2026
@my-senior-dev-pr-review
Copy link
Copy Markdown

🤖 My Senior Dev — Analysis Complete

👤 For @khaliqgant

📁 Expert in packages/ (203 edits) • ⚡ 6th PR this month

View your contributor analytics →


📊 19 files reviewed • 1 need attention

🚨 High Risk:

  • packages/converters/schemas/cursor-plugin.schema.json — The schema may allow improper plugin configurations due to lack of validations.

⚠️ Needs Attention:

  • packages/converters/docs/cursor-plugin.md — Essential documentation for the new cursor plugin format; it needs clarity and completeness to avoid confusion during implementation.

🚀 Open Interactive Review →

The full interface unlocks features not available in GitHub:

  • 💬 AI Chat — Ask questions on any file, get context-aware answers
  • 🔍 Smart Hovers — See symbol definitions and usage without leaving the diff
  • 📚 Code Archeology — Understand how files evolved over time (/archeology)
  • 🎯 Learning Insights — See how this PR compares to similar changes

💬 Chat here: @my-senior-dev explain this change — or try @chaos-monkey @security-auditor @optimizer @skeptic @junior-dev

📖 View all 12 personas & slash commands

You can interact with me by mentioning @my-senior-dev in any comment:

In PR comments or on any line of code:

  • Ask questions about the code or PR
  • Request explanations of specific changes
  • Get suggestions for improvements

Slash commands:

  • /help — Show all available commands
  • /archeology — See the history and evolution of changed files
  • /profile — Performance analysis and suggestions
  • /expertise — Find who knows this code best
  • /personas — List all available AI personas

AI Personas (mention to get their perspective):

Persona Focus
@chaos-monkey 🐵 Edge cases & failure scenarios
@skeptic 🤨 Challenge assumptions
@optimizer Performance & efficiency
@security-auditor 🔒 Security vulnerabilities
@accessibility-advocate Inclusive design
@junior-dev 🌱 Simple explanations
@tech-debt-collector 💳 Code quality & shortcuts
@ux-champion 🎨 User experience
@devops-engineer 🚀 Deployment & scaling
@documentation-nazi 📚 Documentation gaps
@legacy-whisperer 🏛️ Working with existing code
@test-driven-purist Testing & TDD

For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews.

@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Feb 18, 2026

Nitpicks 🔍

🔒 No security issues identified
⚡ Recommended areas for review

  • Remote Exec Risk
    The example plugin.json includes an mcpServers entry that runs npx with a remote package (@playwright/mcp@latest). If PRPM or an editor auto-runs these commands on install/update, this can lead to arbitrary code execution. Ensure install-time execution model and safeguards are documented and recommend pinned versions/checksums.

  • Manifest Ambiguity
    The text states the plugin.json "requires only a name field" but also lists many optional fields without a clear schema link or examples for component directory structure. Authors and converters need an explicit schema (required vs optional, expected paths) to avoid publishing malformed plugins.

  • Format support mismatch risk
    A new test asserts that Cursor supports the plugin subtype (expecting native). Ensure the format-support matrix/implementation actually treats plugin as supported for cursor. If the implementation wasn't updated, this test will be falsely passing or brittle relative to the real support map.

  • Test assertion completeness
    Several newly added tests only assert the conversion strategy type (e.g. 'progressive' or 'native') but do not assert related fields (warnings, primaryFormat/primaryFilename, fallbackFilename, or qualityScore). This makes the tests less robust and allows regressions in other parts of the conversion result structure to go unnoticed.

|---------|------------|-------------|
| `command` | `/api/v1/schemas/cursor/command.json` | Cursor slash commands |
| `hooks` | `/api/v1/schemas/cursor/hooks.json` | Cursor hooks configuration |
| `plugin` | `/api/v1/schemas/cursor/plugin.json` | Cursor plugins (`.cursor-plugin/plugin.json`) |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The Cursor plugin row in the "Get Subtype Schema" section documents an endpoint /api/v1/schemas/cursor/plugin.json that does not exist in the schema routes (only cursor-command and cursor-hooks subtypes are served), so clients following this documentation will receive 404 responses; update the row to avoid advertising a non-existent HTTP schema URL for plugins. [logic error]

Severity Level: Major ⚠️
-`/api/v1/schemas/cursor/plugin.json` always returns 404.
- ⚠️ Cursor plugin authors cannot fetch advertised schema URL.
- ⚠️ `$schema` references from docs mislead external integrations.
- ⚠️ Schema listing endpoint never exposes cursor plugin subtype.
Suggested change
| `plugin` | `/api/v1/schemas/cursor/plugin.json` | Cursor plugins (`.cursor-plugin/plugin.json`) |
| `plugin` | `N/A` | Cursor plugins (`.cursor-plugin/plugin.json`, no HTTP schema endpoint yet) |
Steps of Reproduction ✅
1. Open the schema API documentation at `public-documentation/api/schemas.mdx` and observe
the Cursor subtypes table in the "Get Subtype Schema" section, specifically the `plugin`
row at line 97, which documents the endpoint `/api/v1/schemas/cursor/plugin.json`.

2. Follow the documented pattern and either (a) add `"$schema":
"https://registry.prpm.dev/api/v1/schemas/cursor/plugin.json"` to a
`.cursor-plugin/plugin.json` file, or (b) run `curl
https://registry.prpm.dev/api/v1/schemas/cursor/plugin.json` as suggested by the general
`/api/v1/schemas/:format/:subtype.json` contract described in the same file at lines
75–80.

3. The HTTP request is handled by the subtype route `GET /schemas/:format/:subtype.json`
implemented in `packages/registry/src/routes/schemas.ts` lines 317–371; for this request,
`format='cursor'` and `subtype='plugin'`, so line 346 builds `schemaFilename =
\`${format}-${subtype}.schema.json\``, i.e. `cursor-plugin.schema.json`.

4. Still in `schemas.ts`, line 349 checks `AVAILABLE_SCHEMAS.includes(schemaFilename)`.
`AVAILABLE_SCHEMAS` is built from `BASE_SCHEMA_ENTRIES` and `SUBTYPE_SCHEMA_ENTRIES`
(lines 45–88), and only includes `cursor-command.schema.json` and
`cursor-hooks.schema.json` for Cursor subtypes (lines 75–76 and 105–107);
`cursor-plugin.schema.json` is not present, so the handler returns a 404 response with
error `Schema not found` (lines 349–353), meaning the documented
`/api/v1/schemas/cursor/plugin.json` URL always fails even though a local schema file
exists at `packages/converters/schemas/cursor-plugin.schema.json` with `$id` set to
`https://registry.prpm.dev/api/v1/schemas/cursor-plugin.json`.
Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** public-documentation/api/schemas.mdx
**Line:** 97:97
**Comment:**
	*Logic Error: The Cursor plugin row in the "Get Subtype Schema" section documents an endpoint `/api/v1/schemas/cursor/plugin.json` that does not exist in the schema routes (only `cursor-command` and `cursor-hooks` subtypes are served), so clients following this documentation will receive 404 responses; update the row to avoid advertising a non-existent HTTP schema URL for plugins.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎

@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Feb 18, 2026

CodeAnt AI finished reviewing your PR.

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 19 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/converters/src/to-cursor-plugin.ts">

<violation number="1" location="packages/converters/src/to-cursor-plugin.ts:94">
P2: The generated plugin.json never sets rules/agents/skills/commands/hooks based on pluginContents, so Cursor won’t know where to load bundled files from. Populate those fields from pluginContents when present (as the plugin.json spec requires).</violation>
</file>

<file name="packages/converters/src/format-registry.json">

<violation number="1" location="packages/converters/src/format-registry.json:27">
P2: Cursor plugins live under `.cursor-plugin`, but auto-detection only checks `.cursorrules` and the base directory of the first subtype (`.cursor`). Repos containing only `.cursor-plugin/plugin.json` will not be detected as cursor format. Consider adding `.cursor-plugin/plugin.json` to `rootFiles` or updating detection to scan all subtype directories.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

}

// Get plugin contents from stored metadata
const pluginContents: CursorPluginContents = storedPluginData?.contents || {
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The generated plugin.json never sets rules/agents/skills/commands/hooks based on pluginContents, so Cursor won’t know where to load bundled files from. Populate those fields from pluginContents when present (as the plugin.json spec requires).

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/src/to-cursor-plugin.ts, line 94:

<comment>The generated plugin.json never sets rules/agents/skills/commands/hooks based on pluginContents, so Cursor won’t know where to load bundled files from. Populate those fields from pluginContents when present (as the plugin.json spec requires).</comment>

<file context>
@@ -0,0 +1,178 @@
+    }
+
+    // Get plugin contents from stored metadata
+    const pluginContents: CursorPluginContents = storedPluginData?.contents || {
+      rules: [],
+      agents: [],
</file context>
Fix with Cubic

"fileExtension": ".md"
},
"plugin": {
"directory": ".cursor-plugin",
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Cursor plugins live under .cursor-plugin, but auto-detection only checks .cursorrules and the base directory of the first subtype (.cursor). Repos containing only .cursor-plugin/plugin.json will not be detected as cursor format. Consider adding .cursor-plugin/plugin.json to rootFiles or updating detection to scan all subtype directories.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/src/format-registry.json, line 27:

<comment>Cursor plugins live under `.cursor-plugin`, but auto-detection only checks `.cursorrules` and the base directory of the first subtype (`.cursor`). Repos containing only `.cursor-plugin/plugin.json` will not be detected as cursor format. Consider adding `.cursor-plugin/plugin.json` to `rootFiles` or updating detection to scan all subtype directories.</comment>

<file context>
@@ -22,6 +22,11 @@
           "fileExtension": ".md"
+        },
+        "plugin": {
+          "directory": ".cursor-plugin",
+          "filePatterns": ["plugin.json"],
+          "fileExtension": ".json"
</file context>
Fix with Cubic

@khaliqgant khaliqgant merged commit 5b27b44 into main Mar 17, 2026
12 checks passed
@khaliqgant khaliqgant deleted the cursor-plugins branch March 17, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:XL This PR changes 500-999 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant