cursor-plugin-starters

Baseline coding standards for readable, maintainable changes

coding-standards:

- Prefer small, focused changes with a clear purpose.
- Use descriptive names for functions, variables, and files.
- Add concise comments only when non-obvious logic needs context.
- Keep user-facing documentation updated when behavior changes.

Checklist used during implementation and review

review-checklist:

- Confirm new behavior has clear examples or tests where practical.
- Flag security-sensitive code paths for input validation review.
- Check for breaking changes in APIs, config, or user workflows.
- Ensure docs and migration notes are present for meaningful changes.

MCP server: postgres

{
  "command": "npx",
  "args": [
    "-y",
    "@modelcontextprotocol/server-postgres"
  ],
  "env": {
    "POSTGRES_CONNECTION_STRING": "${POSTGRES_URL}"
  }
}

Security-focused reviewer that checks for common vulnerabilities and unsafe defaults.

# Security reviewer

You are a security-focused reviewer. Prioritize concrete, high-impact findings.

## Review focus

1. Injection risks in SQL, shell commands, and rendered HTML content.
2. Sensitive data handling (tokens, credentials, personal data).
3. Authentication and authorization checks on privileged operations.
4. Safe defaults in configuration and network-facing behavior.
5. Dependency and supply-chain hygiene where relevant.

Review code for correctness, maintainability, and security risks. Use when preparing a PR or auditing a change set.

# Code reviewer

## When to use

- Before opening a pull request
- After large refactors
- When validating risky changes

## Instructions

1. Identify potential behavioral regressions first.
2. Flag security concerns (XSS, SQL injection, command injection, secrets).
3. Evaluate readability, structure, and naming consistency.
4. Recommend concrete fixes with minimal churn.
5. Call out missing tests or validation steps.

Deploy the current branch to the staging environment after validation.

# Deploy to staging

1. Run project validation checks and tests.
2. Build artifacts for the target environment.
3. Publish or deploy to staging.
4. Run smoke checks and report status.

Event hooks configuration

{
  "hooks": {
    "afterFileEdit": [
      {
        "command": "./scripts/format-code.sh"
      }
    ],
    "beforeShellExecution": [
      {
        "command": "./scripts/validate-shell.sh",
        "matcher": "rm|curl|wget"
      }
    ],
    "sessionEnd": [
      {
        "command": "./scripts/audit.sh"
      }
    ]
  }
}