| cursor-api-key | Cursor API key. Pass from secrets.CURSOR_API_KEY. | yes | — |
| github-token | GitHub token used to create or update PR comments. Pass github.token. | no | "" |
| base-sha | Base SHA for PR diff. | no | "" |
| head-sha | Head SHA for PR diff. | no | "" |
| pr-number | Pull request number. Required when comment-mode is not off. | no | "" |
| pr-title | Pull request title for review context. | no | "" |
| pr-body | Pull request body for review context. | no | "" |
| base-ref | Base branch name for review context. | no | "" |
| head-ref | Head branch name for review context. | no | "" |
| pr-is-fork | Whether the pull request head repository is a fork. Pass github.event.pull_request.head.repo.fork when available. | no | "" |
| comment-author-association | GitHub author association for issue_comment slash commands. | no | "" |
| trusted-author-associations | Comma-separated author associations allowed to run issue_comment slash commands. | no | OWNER,MEMBER,COLLABORATOR |
| commit-messages | Newline-separated commit messages for review context. | no | "" |
| event-name | GitHub event name, usually github.event_name. | no | "" |
| comment-body | PR comment body for command trigger, usually github.event.comment.body. | no | "" |
| user-prompt | Extra user instructions. Overrides command text extracted from comment-body. | no | "" |
| trigger-phrase | Manual review trigger phrase. | no | /cursor-review |
| command | Command to run: review, ask, improve, describe, or help. | no | review |
| enabled-commands | Comma-separated enabled commands. | no | review |
| config-path | Repo-local config file path. | no | .cursor-review.yml |
| model | Cursor model. Use auto unless you know the account supports a specific model. | no | auto |
| language | Output language. | no | zh-CN |
| review-focus | Comma-separated review focus list. | no | correctness,security,performance,tests,edge-cases |
| max-findings | Maximum actionable findings to return. | no | 5 |
| max-diff-bytes | Maximum diff bytes sent to Cursor. | no | 120000 |
| max-files | Maximum changed files to include in the selected diff. Use 0 for unlimited. | no | 0 |
| max-hunks | Maximum diff hunks to include in the selected diff. Use 0 for unlimited. | no | 0 |
| max-cursor-calls | Maximum Cursor CLI calls allowed for one action run. Current engine defaults to one call. | no | 1 |
| timeout-seconds | Per Cursor CLI call timeout in seconds. | no | 600 |
| filter-mode | Diff filter mode: added, diff_context, file. | no | added |
| include-patterns | Comma-separated file globs to include. | no | "" |
| exclude-patterns | Comma-separated file globs to exclude. | no | "" |
| scope-mode | Review scope mode: full or files. Defaults to the full selected PR diff. | no | full |
| scope-files | Comma-separated repository-relative paths or globs when scope-mode is files. | no | "" |
| persistent-comment | Update the previous Cursor Review comment instead of creating a new one. | no | true |
| comment-mode | Comment mode: update, create, or off. | no | update |
| fail-on-error | Fail the workflow if Cursor review fails. | no | false |
| fail-on-findings | Fail the workflow when high severity findings are found. Reserved for future use. | no | false |
| debug-artifacts | Write redacted prompt and raw Cursor output debug files. Off by default to avoid storing raw PR data. | no | false |
| install-cursor | Install Cursor CLI before running review. | no | true |