Review and triage templates

Each template is one model turn. A review template reads the diff and posts one comment, and the triage template comments on a ticket you already filed.

Template	--template id	What it posts	Channel
Security reviewer	security-reviewer	One comment on exploitable bugs, such as injection, authz bypass, secret leaks, SSRF, and RCE	GitHub
Thermo review	thermo-review	One comment on bugs, breaking side effects, and unintended feature exposure	GitHub
Thermo quality review	thermo-quality-review	One comment on structure, such as missing abstractions, deep nesting, and files past 1,000 lines	GitHub
Triage	triage-linear, triage-jira, or triage	A Triage: comment, a bug priority, and a duplicate link when titles match	Linear or Jira

triage is short for triage-linear. No review template comments on style, and the quality template doesn't argue about behavior.

The Agentic Approver template is separate. It applies an owners policy instead of posting one findings comment.

Scaffold

agent-sdk init ./security-reviewer --template security-reviewer \
  --var repos=acme/api

Swap the folder and the --template id for the row you want. --var repos is only for security-reviewer. Name repositories already connected in Cursor, separated by commas, and they must share one owner. init writes that list to bot/lib/repos.ts.

Try it locally

Connect GitHub in Cursor for the repositories you watch (Settings or cursor.com/dashboard), then sign the host in with agent-sdk login. The GitHub guide covers cursorAccount.

agent-sdk dev --cursor-events --repo acme/api
agent-sdk github replay https://github.com/acme/api/pull/12 --dir .

You need pull access to replay. The channel skips drafts, writes the diff to pr/diff.patch, and starts a turn. The model calls post_findings once, and that call writes the GitHub comment. Chat replies stay in the playground.

agent-sdk eval

Eval sessions skip the GitHub write. Edit bot/instructions.md for what counts as a finding, and edit evals/review.eval.ts for the smoke cases.

Deploy

From the agent's git checkout:

agent-sdk login
agent-sdk deploy --cursor-events-repo acme/api

Repeat --cursor-events-repo for each repository, and every repository must share one owner. The deployment watches those repositories through your team's Cursor GitHub connection, and you can change the list later without a redeploy:

agent-sdk deployment update my-agent --event-repo acme/api --event-repo acme/web

Triage a tracker

The template runs after someone files a ticket, so keep filing them as you do now. Connect Linear or Jira under MCP in the Cursor dashboard, then run agent-sdk dev and open /queue/issue in the playground.

curl -X POST http://127.0.0.1:3000/triage-agent/v1/channels/queue/issue \
  -H 'content-type: application/json' \
  -d '{
    "identifier": "ENG-142",
    "title": "CSV export returns 500",
    "description": "Export has returned 500 since this morning."
  }'

For create webhooks, set LINEAR_WEBHOOK_SECRET or JIRA_WEBHOOK_SECRET and point the provider at /v1/channels/webhook on the deployed alias. record_triage comments on the issue that started the session. Edit bot/skills/triage-rubric.md for kinds and what urgent means on your team. Eval sessions skip tracker writes.