Cursor's Code Hosting Platform Origin Opens an App Marketplace: 20+ Integrations, Open to Tool Teams

One boundary to draw up front: our cycle47 piece on October 6 (Agents on your computer, overseers in your pocket: Cursor ships iOS remote control for local agents, slug: cursor-remote-control-local-agents-october-2026) covered the iOS app for remotely watching local agents — a different feature. And Origin itself, the code hosting platform launched back in August, has never had a standalone piece on this site. This article is not a belated Origin launch write-up; it covers one new event from October 13: the Origin App Marketplace is open.

On October 13, 2026, Cursor published a new entry in its official changelog: the Origin App Marketplace. In one sentence: Origin — the code hosting platform designed for the agent era — now has an app marketplace. The launch lineup counts 21 integrations across six categories: deployments, CI, code review, security, monitoring, and project management. More importantly, the marketplace is open to public submissions from any developer-tool team, starting today.

This is not a routine "a few more integrations" update. When Origin launched in August it carried only three launch integrations — Vercel, Depot, and Buildkite. Two months later that number is 21, and it comes with a complete third-party publishing mechanism. Cursor is clearly playing a bigger game.

What actually shipped: 21 integrations, six categories

The official wording is "over 20"; the changelog names exactly 21, grouped by category:

• Deployments (5): Cloudflare, Netlify, Render, Spacelift, Vercel
• CI (7): Buildkite, CircleCI, CloudBees, Depot, EngFlow, Namespace, RWX
• Code review (3): CodeRabbit, Greptile, Tenki
• Security (4): Artemis Security, Semgrep, Socket Security, Upwind
• Monitoring (1): Sentry
• Project management (1): Linear

The list repays a close read. CI has the most entries at seven, which tells you Cursor understands the reality: the flood of agent-produced code hits continuous integration first. Deployments (five) and security (four) come next — agent-written code arrives fast and in volume, and without deployment pipelines and security scanning keeping pace, the repo quickly becomes a graveyard nobody dares merge into. In code review, CodeRabbit and Greptile are two of the hottest AI review tools right now; putting them in amounts to installing the "AI writes, AI reviews" loop directly inside the hosting platform.

Official Cursor product screenshot: dark-theme editor interface with AI agent panel

Monitoring has only Sentry and project management only Linear, which reads as placeholder coverage — the ecosystem is far from filled in on those two tracks, and that is precisely the gap the open submissions are meant to close. The absences are informative too: no Datadog, no native GitHub Actions support (only the compatibility layer via Depot and Buildkite), no Jira. Cursor clearly started with partners willing to commit on day one rather than trying to sign the whole industry at once.

The submission flow: GitHub Apps' homework, copied

The real substance of this release is not the 21 integrations but the public publishing mechanism. Four steps:

• 1. Create an app in your namespace. While you build, the app stays private to your own namespace — effectively a sandbox.
• 2. Build against the Origin API. Apps authenticate with an app JWT plus installation access tokens, receive webhook events, and can write back check runs, pull request comments, and reviews.
• 3. Make it public and submit. From the app's page, submit a slug, suggested tags, and a demo video — the video must show install, uninstall, and the core product flows. All three, no exceptions.
• 4. Official review; listed once approved. The Cursor team reviews manually, and the app becomes discoverable in the marketplace only after passing.

Official Cursor product screenshot: dark-theme editor interface with AI agent panel

Anyone familiar with the GitHub ecosystem will recognize this: it is the GitHub Apps model, ported almost verbatim. Namespace-private development maps to a GitHub App's draft state; the two-layer app JWT + installation token auth is the GitHub Apps standard; webhooks plus writing back check runs and PR comments are straight out of the GitHub platform playbook. Copying the homework is no shame — GitHub Marketplace spent over a decade validating this model, and what Cursor needs is the fastest possible path for developer-tool vendors to port over painlessly.

One detail speaks volumes: the demo video is required to show "install, uninstall, and your core product flows." Putting uninstall on the mandatory list is a classic anti-rot measure for app marketplaces — a market that accepts entries but never evictions ends up a zombie-app graveyard. Cursor wrote that rule on day one, which suggests it has real expectations for ecosystem quality rather than chasing raw counts.

The changelog also mentions, almost in passing, an Origin Apps plugin that answers questions from the live Origin API docs and can plan a port to Origin for an app you already run. Cursor is investing in lowering porting costs — it knows tool vendors' time is the scarcest resource, and whoever makes the port "an afternoon's work" wins the ecosystem first.

First ecosystem instances: Socket and Upwind are already in

The marketplace opened with security vendors already listed. Both instances come from the vendors' own official channels, timed right against the changelog:

• Socket for Origin (Socket's official blog, 2026-10-14): dependency security scanning inside PRs. When a PR opens or new commits are pushed, it scans dependency changes in manifests and lockfiles; results flow back into Origin through two channels — a policy-based check ("Socket Security / Dependency scan," showing progress, a verdict based on the team's policies, and a link to the full report, re-runnable directly in Origin) and PR comments carrying dependency overviews, scores, severity labels, and report links, which update automatically as the PR changes. Reviewers see dependency risk without leaving the PR.
• Upwind (Upwind's official feed, 2026-10-13): cloud security scanning wired into Origin, under the banner of "securing software factories." Its pitch is tuned exactly to the agent era: every PR gets the same check regardless of size or of who — or what — wrote it, and security coverage scales with agent output instead of reviewer headcount.

Security vendors moving first is no coincidence. Agent-generated code has already outrun human security review for good; security tooling has to live inside the code hosting platform rather than exist as an external step. Socket's two-channel design (check + PR comments) is also worth noting: it invented no new interaction, it simply inserted itself into the two places developers already look — the PR timeline and the checks list. Good platform integrations work like that: never educate the user, just show up where the user was already going to look.

Background: two months, from 3 integrations to 21

Straighten out the timeline and this update's position becomes clear:

• August 17, 2026: Origin launches. Positioned as code hosting "designed for agent scale": repos, pull requests, code browsing, plus GitHub sync. Origin-hosted repos treat Origin as the single source of truth; repos synced from GitHub keep GitHub as the source of truth with Origin mirroring, and PRs sync both ways.
• Same August window: three launch integrations. Vercel, Depot, Buildkite. Vercel gives every PR a preview deployment; Depot and Buildkite handle CI — and critically, both run your existing GitHub Actions workflows with no rewrites. A textbook compatibility-layer strategy: drive migration cost to zero first, talk ecosystem later.
• October 6, 2026: iOS remote control for local agents. Watch locally running agents from your phone, send them messages. Already covered in our cycle47 piece.
• October 13, 2026: the App Marketplace opens. The subject of this article.

Read together, Cursor's strategy is visibly converging: where the code is, the agents are, and the agent toolchain has to be there too. October 6 connected people to their local agents (remote control from a phone); October 13 connects the toolchain to code hosting (the marketplace). Code, agents, and infra are being pulled onto the same plane.

Our take: the forge wars enter the ecosystem phase

Analysis zone below — facts and judgments are labeled separately.

Judgment 1: Cursor is replicating GitHub Marketplace's ecosystem moat. In the code hosting ("forge") category, GitHub's decade-plus dominance never rested on git features alone; it rested on the moat of Actions + Marketplace + Apps. Origin has walked GitHub's ten-year road in two months: hosting first, integrations second, open submissions third. That is not a coincidence; it is copying from the answer key. The difference: GitHub's ecosystem serves code written by humans, while Origin's serves code written by agents — and in the agent era, CI, security, and deployment are not nice-to-haves but load-bearing: without them installed next to the code, nothing moves.

Judgment 2: this closes a loop with the review-bottleneck and infra-bottleneck theses. Two earlier pieces on this site link directly: the Harvard Jellyfish piece on AI multiplying code output while human review becomes the bottleneck, and the Anthropic-built-Scion piece on source-control infra itself becoming the bottleneck in the agent era. Together the three form one logical chain: agents produce a daily flood of code → humans cannot review it all → the CI/security/deploy infra next to the hosting platform must be automated and must live next to the code. The Origin App Marketplace is the "growing out" step in that chain: it is not selling integrations, it is selling the infrastructure slots next to the flood.

Judgment 3: for vibe developers, the criteria for choosing a code host have changed. It used to be git features, permission models, and price. Now, if your code is mostly agent-written, the real questions are: does this host have the agent ecosystem I need next to it? Can CI run my workflows directly? Is security scanning automatic at PR level? Does merging mean shipping? Origin's 21 integrations are Cursor's first answer sheet — not necessarily the most complete, but proof that Cursor understands the exam.

Judgment 4: the review gate plus demo-video requirement is Cursor's quality bet on the ecosystem. The classic failure of open submissions is lemons driving out quality: a market stuffed with half-baked apps teaches developers to never search it again after one disappointment. By requiring the demo video to show install, uninstall, and core flows, Cursor pushes the burden of proving "this works" onto the submitter. It is an old-fashioned design, and it works — GitHub Marketplace learned the cost of no-review the hard way in its early years.

What remains unsaid

One more rhythm worth noting: the iOS remote control on October 6 and the marketplace on October 13 are just seven days apart. Cursor is now shipping roughly one weighty release per week. That cadence is itself a signal — the agent coding tool race has entered weekly iteration, and a week's delay can cost you a slice of ecosystem territory. A marketplace that "lets others fill in your ecosystem" is a clever way to distribute that iteration pressure: Cursor doesn't need to sign three integrations a week itself; it just needs the submission lane paved.

What the changelog doesn't say is worth flagging: whether listing costs anything, what the revenue split is, whether there is a separate marketplace strategy for enterprise — none of that is disclosed. Half of an app marketplace's success is the technical mechanism; the other half is the commercial terms, and Cursor hasn't shown those cards yet. Also, the 21 launch names lean visibly toward international incumbents (Cloudflare, Vercel, Sentry, Linear, CircleCI); independent developer tools are barely visible. Whether that ratio changes after open submissions is a metric worth watching next round. Monitoring and project management currently have one placeholder each — will the next batch bring in heavyweights like Datadog and Jira, or some agent-native newcomer? The answer decides whether the Origin ecosystem becomes "yet another distribution channel for traditional DevOps tools" or "the birthplace of agent-era tools" — and the two mean completely different things for vibe developers.

Related reading: our cycle47 piece on Cursor's iOS remote control for local agents (the other half of the same strategy); Harvard Jellyfish on the AI code flood and the review bottleneck; Anthropic's self-built Scion and the source-control infra bottleneck thesis.

In one sentence: the Origin App Marketplace opening marks the agent era's "forge wars" moving from feature competition to ecosystem competition. The deciding factor in code hosting is no longer whose diff UI looks better, but whose agent toolchain next to the code is more complete.