Salesforce Code Review Agent plugin
Cursor plugin that reviews Salesforce DX like an architect: Apex, LWC, Aura, Flows and metadata, with a skill and subagent.
- 108 ★ on the repository
- Last commit
Minimal access
Why this level
- The subagent is read-only, but the install script adds files to `.cursor/` and the project root.
Install
- Works in
Manual install
./scripts/install.sh Project /path/to/your-sfdx-projectRun `git clone` first; Windows has `install.ps1`. Then reload the Cursor window.
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The subagent is read-only, but the install script adds files to `.cursor/` and the project root.
This is third-party code. Review the repository files before installing.
What it does
A Cursor agent that reviews Salesforce DX source the way a platform architect would. It ships the `/salesforce-code-review` skill with checklists for governors, CRUD and FLS, injection, tests, LWC XSS and Flow bulkification, a read-only `salesforce-code-reviewer` subagent so reviews run in their own context, and the `/review-salesforce` slash command. Rules apply when Apex, LWC or Flow files are in scope. A `BUGBOT.md` file makes Cursor Agent Review and Bugbot use the same bar. Optionally the agent merges Salesforce CLI and Code Analyzer output into the report. Installation copies skills, the subagent, commands and rules into your project's `.cursor/` folder so the whole team gets the same reviewer.
Who it is for. Salesforce developers and tech leads running a Salesforce DX project in Cursor who want one review standard.
Good fit when
- Before merging, an Apex class needs a check for governor limits and CRUD and FLS rights.
- An LWC component has to be searched for XSS and unsafe rendering.
- A Flow processes records one by one and must be moved to bulk handling.
- Everyone on the repository should get the same reviewer through a committed `.cursor/` folder.
Not a fit when
- The project is not on Salesforce DX; the checklists are written only for that platform.
- You need automatic code fixes; the agent only reads and writes a report.
- You do not work in Cursor, which the plugin targets.
Example request
Review the changes in force-app with /review-salesforce and separate security findings from governor-limit findings.Limitations
The agent targets desktop Cursor and a Salesforce DX project with `sfdx-project.json`. It only reads code and writes a report, so you make the edits yourself. Salesforce CLI and Code Analyzer output enters the report only if those tools are installed. It works from checklists, so it does not replace a full analyzer or human review, and load estimates against governor limits need confirming with tests. A project install adds `BUGBOT.md` and `AGENTS.md` if they are missing, and after copying you reload the Cursor window. The install script for macOS and Linux needs execute permission.
How to disable. Delete the copied skills, subagent, commands and rules from the project's `.cursor/` folder, plus the added `BUGBOT.md` and `AGENTS.md` if you do not need them.
FAQ
How do I install the agent into a project?
Clone the repository and run `./scripts/install.sh Project /path/to/your-sfdx-project`. On Windows use `.\scripts\install.ps1 -Target` with the project path.
How do I check the install worked?
Open the project in Cursor, reload the window with Developer: Reload Window and type `/review-salesforce` in Agent chat. The command should appear in the list.
What does the skill check?
Governor limits, CRUD and FLS rights, injection, tests, LWC XSS and Flow bulkification. It covers Apex, LWC, Aura, Flows and metadata.
Does the agent change code?
No. The `salesforce-code-reviewer` subagent is read-only and writes a report in its own context.
What is BUGBOT.md for?
It makes Cursor Agent Review and Bugbot apply the same Salesforce bar as the skill.
Discussion
No questions or reviews yet.
Related
PluginsA code-review CLI and plugin for agents: reads a git diff and writes line-level comments with context
A skill and CLI for code review: a team of reviewer agents inspects changes independently, debates findings and produces one report
CodeRabbit plugin and skills for Claude Code, Cursor, Codex and 35 more agents: change reviews, fixes from comments, config
A CLI and three skills that work through review-bot comments on a PR: assess findings, fix code, reply and wait for checks
Salesforce's official set of agent skills for platform development: Apex, Flow, SOQL, Lightning Web Components, metadata and deployment
cross-review sends plans and code to a second model for review: Codex, Claude Code or Antigravity checks your agent's work.
README in short
The repository packages a skill, subagent, command and rules for Salesforce review in Cursor and installs by copying into the project's `.cursor/` folder.