Securing our codebase with autonomous agents

This post details the evolution of Cursor's security tooling, moving from static analysis to autonomous agents. It introduces four new security automation templates: Agentic Security Review, Vuln Hunter, Anybump, and Invariant Sentinel. The core technical contribution lies in the 'automations architecture' which provides out-of-the-box integrations for webhooks, GitHub PRs, and codebase monitoring, powered by cloud agents. A key component is the security MCP (Master Control Program) tool, implemented as a serverless Lambda function, which enables persistent data storage for impact tracking, deduplication of LLM-generated findings using a Gemini Flash 2.5 classifier, and consistent output formatting for Slack messages and actions. Agentic Security Review evolved from Bugbot to focus specifically on security, implementing blocking gate checks. Vuln Hunter scans existing codebases for vulnerabilities. Anybump automates dependency patching by performing reachability analysis, tracing code paths, running tests, and opening PRs. Invariant Sentinel monitors engineering invariants daily, detecting drift and revalidating against previous runs.