Cursor 发布 Rollouts 和 Security Reviewer 开发机器人

今天我们发布了软件开发机器人，帮助你更快地将安全、可靠的代码投入生产。

编写代码已经不再是慢的部分。没有加快的是 PR 提交之后的一切工作：确保代码安全、监控部署、判断延迟增加是否真实、找出十一处变更中哪一处导致了结账失败。

这些工作既困难又重复，还需要大量上下文。听起来这正是机器人应该做的工作类型！

我们曾说过，我们在构建自动驾驶代码库。Rollouts 和 Security Review 可以自主处理每个软件团队都希望有更多专业知识和时间完成的常见任务。

Rollouts 会从 PR 打开那一刻开始，跟踪变更，直到你确信它在生产环境中正常运行。

连接源代码管理、部署系统和你的遥测工具（Datadog、Grafana、Honeycomb，或你存放指标与跟踪的地方）。合并前，Rollouts 会读取差异并编写监控计划：它看到的风险、变更应产生的效果，以及那些你的监控工具无法判断是否成功的地方。如果计划中有遗漏，可以编辑。

部署后，Rollouts 会将计划中的信号与部署前基准进行对比。当发现回归时，它会告诉你怀疑的变更和计划采取的操作。根据你的配置，这可能是向作者发送通知、暂停渐进式发布，或等待批准的回滚 PR。

即将推出：功能开关集成，使 Rollouts 能够直接增加或减少流量，并具备对发布列车和部署冻结的感知能力。

Security Reviewer 会在每个 PR 上运行，在整个代码库的上下文中读取变更，并报告漏洞，同时提供解释和建议的修复方案。

静态分析模式匹配：它会标记 SQL 调用附近的每个字符串拼接，但却漏掉在重构后停止运行的授权检查。Security Review 以安全工程师的方式读取代码：用户输入从哪里进入，最终去向何处，途中经过哪些环节。

每个发现都包含严重性、攻击路径和一键修复方案。

Rollouts 和 Security Reviewer 今天可在 Teams 和 Enterprise 计划中使用。请从自动化功能启用任一机器人：https://cursor.com/automations 标签页开始使用。

归档于：产品：/博客/主题/产品

云代理的启动速度因构建而提升 3 倍

Bugbot 现在速度提高 3 倍以上，成本降低 22%，并且发现的 bug 数量增加 10%

Today we're releasing software development bots that help you get safe, reliable code into production faster.

Writing code is no longer the slow part. What hasn't sped up is everything after the PR goes up: making sure code is secure, watching the deploy, deciding whether a latency bump is real, figuring out which of eleven changes broke checkout.

That work is hard, repetitive, and needs a lot of context. Sounds like the type of work that bots should be doing!

We've said we're building toward self-driving codebases. Rollouts and Security Review autonomously handle common tasks every software team wishes they had more expertise and time to do.

Rollouts tracks a change from the moment the PR opens to the moment you're confident it works in production.

Connect source control, your deploy system, and your telemetry (Datadog, Grafana, Honeycomb, or wherever your metrics and traces live). Before merge, Rollouts reads the diff and writes a monitoring plan: the risks it sees, the effects the change is supposed to have, and the places your instrumentation can't tell you whether it worked. Edit the plan if it's missing something.

After deploy, Rollouts compares the signals in the plan against the pre-deploy baseline. When it finds a regression, it tells you which change it suspects and what it plans to do. Depending on how you've configured it, that's a ping to the author, a paused progressive rollout, or a revert PR waiting for approval.

Coming soon: feature flag integration so Rollouts can ramp and unramp traffic directly, and awareness of release trains and deploy freezes.

Security Reviewer runs on every PR, reads the change in the context of the whole codebase, and reports vulnerabilities with an explanation and a proposed fix.

Static analysis pattern-matches: it flags every string concatenation near a SQL call and misses the authorization check that stopped running after a refactor. Security Review reads code the way a security engineer does: where does user input enter, where does it end up, what does it pass through on the way.

Each finding has a severity, an attack path, and a one-click fix.

Rollouts and Security Reviewer are available today on Teams and Enterprise plans. Enable either bot from the automations：https://cursor.com/automations tab to get started.

Filed under: product：/blog/topic/product

Cloud agents start 3x faster with builds

Bugbot is now over 3x faster, 22% cheaper, and finds 10% more bugs