Works with · Cursor Bugbot · Cursor
Does Cursor Bugbot count as code review for SOC 2?
Not as the approval. Bugbot posts bug findings on each push from a bot account; it finds defects, it does not approve changes, and it is not a person. For the change-management control an auditor needs a qualified non-author approver. PSCO is that approver and reads Bugbot’s findings before deciding.
How Cursor Bugbot reviews
Bugbot scans each push to a pull request for bugs and regressions and posts findings as comments, with a confidence signal and a suggested fix where it has one.
What it cannot do
Cursor Bugbot cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
Each Bugbot finding becomes a structured finding on the Officer’s packet with its path, line and severity. The Officer confirms whether the author addressed it before approving.
Two-step setup
Keep Cursor Bugbot.
Keep Bugbot enabled on the repository.
Add PSCO.
Install the PSCO GitHub App, select the repos in scope, and require psco/approved plus one approval from @psco-officers.
The shared-model tip
Point it at the same model the Officer uses.
Point Cursor at the same rulebook the Officer uses. Reference psco.model.yaml from your .cursor/rules so the agent writing the code and the Officer approving it follow the same rules. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Cursor Bugbot. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.