Cursor Origin

Install heyGRC on Cursor Origin. Native Origin-hosted repositories only. GitHub-synced copies stay on the GitHub App.

Cursor Origin is a git host. heyGRC reviews pull requests there the same way it does on GitHub: findings in a review, a heyGRC check, install-first (reviews run before you create a console account).

What Origin can see

Origin apps cannot reach repositories that Origin only mirrors in from GitHub. If GitHub is the source of truth, install the GitHub App. If the repository lives on Origin, install heyGRC on Origin.

Install

Open heygrc.com/for/origin and click the Origin install button.
Choose the Origin namespace and either all repositories or selected ones.
Open a pull request on a native Origin repo. heyGRC posts a review body and a check.

There is no first-party tile next to Vercel / Depot / Buildkite yet. Install is via URL. Cursor lists those three as partner Suggested Apps. heyGRC is a registered Origin App (heygrc) and is not in that tab until Cursor approves a public listing.

What a review looks like

A submitted Origin review (comment verdict) with the findings summary.
A heyGRC check run on the head commit.
No line-anchored comments. Origin's partner API does not expose path/line comments yet. The summary is the source of truth.

Pricing

Unchanged. Public repos are free. Private repos use the existing free cap (25/month) and a 14-day trial when you claim the install in the console. See pricing.

Permissions heyGRC asks Origin for

Scope	Why
`repository:contents:read`	Read the diff and optional `.heygrc.md`
`repository:pull_requests:read`	Read the pull request
`repository:pull_requests:reviews:read`	Read existing reviews so later pushes can update the sticky summary
`repository:pull_requests:reviews:write`	Post the review and conversation comment
`repository:checks:write`	Post the heyGRC check

You pick the repositories. heyGRC cannot widen that grant.