| [ Web Proxy ] |
| Viewing: https://cursor.com/docs/integrations/github | [Back] [Original] |
Search for a command to run...
The Cursor GitHub app connects your repositories so you can use features like Cloud Agents and Bugbot.
Requires Cursor admin access and GitHub org admin access.
To disconnect your GitHub account, return to the integrations dashboard and click Disconnect Account.
If your organization uses GitHub's IP allow list feature to restrict access to your repositories, Cursor can be configured to use a hosted egress proxy with a narrow set of IPs.
The recommended GitHub Apps setting is configured in GitHub. You do not need Cursor to enable it. If you add the git egress proxy IPs yourself instead, contact hi@cursor.com so we can enable git egress proxy for your team. Otherwise git traffic may not come from those addresses.
The Cursor GitHub app has the IP list already pre-configured. You can enable the allowlist for installed apps to automatically inherit this list. This is the recommended approach, as it allows us to update the list and your organization receives updates automatically.
This inherits the IP list registered on the Cursor GitHub App. It does not allow every client that happens to use those addresses.
To enable this:
For detailed instructions, see GitHub's documentation.
If your organization uses IdP-defined allowlists in GitHub or otherwise cannot use the pre-configured allowlist, add the proxy IPs listed in Git egress proxy and IP allow list.
Self-hosted instances support multiple connection methods beyond IP whitelisting. For setup details and supported private networking options, see Private Connectivity.
Available for Enterprise customers. Use AWS PrivateLink when your GitHub Enterprise Server is in AWS or can sit behind an AWS Network Load Balancer. PrivateLink can cover Cursor accessing GHES and, when needed, GHES sending webhooks back to Cursor without public internet egress.
Best for: AWS-hosted GHES instances and teams that want private VPC endpoint connectivity
Security: HTTPS encryption, AWS PrivateLink, VPC endpoint policies, service account access tokens
Drawbacks: Requires coordination with Cursor and AWS endpoint service setup.
Available for Enterprise customers. Use Cloudflare Tunnel when AWS PrivateLink is not practical or when you need an outbound-only deployment model. Your network runs cloudflared, and Cursor provides the tunnel hostname and token.
Best for: Environments without inbound network access
Security: HTTPS encryption, Cloudflare Tunnel, service account access tokens
Drawbacks: Requires running and maintaining cloudflared in your environment.
The GitHub app requests the following permissions to support Cursor features:
| Permission | Purpose |
|---|---|
| Repository access | Clone your code and create working branches |
| Pull requests | Create PRs and leave review comments |
| Issues | Track bugs and tasks discovered during reviews |
| Checks and statuses | Report on code quality and test results |
| Actions and workflows | Monitor CI/CD pipelines and trigger CI re-runs from pull requests |
| Administration | Read branch protection and required check rules to determine PR mergeability |
| Custom repository roles | Determine user access levels so the correct merge and review options appear |
| Organization custom properties | Surface organization-defined repository metadata in filtering |
All permissions follow the principle of least privilege.
Lock your GitHub organization to your Cursor organization so only your teams can use its repositories with Cloud Agents, automations, and Bugbot. Protecting a scope requires GitHub organization owner or admin access. See Protected Git Scopes.
Once your GitHub integration is connected, configure the features that use it:
Search for a command to run...
The Cursor GitHub app connects your repositories so you can use features like Cloud Agents and Bugbot.
Requires Cursor admin access and GitHub org admin access.
To disconnect your GitHub account, return to the integrations dashboard and click Disconnect Account.
If your organization uses GitHub's IP allow list feature to restrict access to your repositories, Cursor can be configured to use a hosted egress proxy with a narrow set of IPs.
The recommended GitHub Apps setting is configured in GitHub. You do not need Cursor to enable it. If you add the git egress proxy IPs yourself instead, contact hi@cursor.com so we can enable git egress proxy for your team. Otherwise git traffic may not come from those addresses.
The Cursor GitHub app has the IP list already pre-configured. You can enable the allowlist for installed apps to automatically inherit this list. This is the recommended approach, as it allows us to update the list and your organization receives updates automatically.
This inherits the IP list registered on the Cursor GitHub App. It does not allow every client that happens to use those addresses.
To enable this:
For detailed instructions, see GitHub's documentation.
If your organization uses IdP-defined allowlists in GitHub or otherwise cannot use the pre-configured allowlist, add the proxy IPs listed in Git egress proxy and IP allow list.
Self-hosted instances support multiple connection methods beyond IP whitelisting. For setup details and supported private networking options, see Private Connectivity.
Available for Enterprise customers. Use AWS PrivateLink when your GitHub Enterprise Server is in AWS or can sit behind an AWS Network Load Balancer. PrivateLink can cover Cursor accessing GHES and, when needed, GHES sending webhooks back to Cursor without public internet egress.
Best for: AWS-hosted GHES instances and teams that want private VPC endpoint connectivity
Security: HTTPS encryption, AWS PrivateLink, VPC endpoint policies, service account access tokens
Drawbacks: Requires coordination with Cursor and AWS endpoint service setup.
Available for Enterprise customers. Use Cloudflare Tunnel when AWS PrivateLink is not practical or when you need an outbound-only deployment model. Your network runs cloudflared, and Cursor provides the tunnel hostname and token.
Best for: Environments without inbound network access
Security: HTTPS encryption, Cloudflare Tunnel, service account access tokens
Drawbacks: Requires running and maintaining cloudflared in your environment.
The GitHub app requests the following permissions to support Cursor features:
| Permission | Purpose |
|---|---|
| Repository access | Clone your code and create working branches |
| Pull requests | Create PRs and leave review comments |
| Issues | Track bugs and tasks discovered during reviews |
| Checks and statuses | Report on code quality and test results |
| Actions and workflows | Monitor CI/CD pipelines and trigger CI re-runs from pull requests |
| Administration | Read branch protection and required check rules to determine PR mergeability |
| Custom repository roles | Determine user access levels so the correct merge and review options appear |
| Organization custom properties | Surface organization-defined repository metadata in filtering |
All permissions follow the principle of least privilege.
Lock your GitHub organization to your Cursor organization so only your teams can use its repositories with Cloud Agents, automations, and Bugbot. Protecting a scope requires GitHub organization owner or admin access. See Protected Git Scopes.
Once your GitHub integration is connected, configure the features that use it:
| Web Proxy Viewer | New URL | Original Page |