Skip to main content

Command Palette

Search for a command to run...

Origin

Commands

Every origin command with its options, except pull requests and stacks, which have their own pages: Pull request commands and Stack commands. To see the same information in your terminal, run origin --help for the command list or origin <group> --help for one group. To install the CLI, see Install the CLI.

The Origin CLI (origin) is separate from the Cursor Agent CLI (agent) documented under CLI.

Global options

These work with any command:

OptionDescription
--versionShow the installed version
-h, --helpShow help for the current command

The CLI reads the API endpoint and credentials from the environment, as CURSOR_ORIGIN_ENDPOINT, CURSOR_AUTH_TOKEN, and CURSOR_API_KEY. See Environment variables.

Command groups

CommandDescriptionUsage
authSign in, sign out, and configure git authenticationorigin auth login
repoCreate, view, edit, clone, mirror, and delete repositories, and manage their accessorigin repo create my-project
prCreate, review, and merge pull requestsorigin pr create
stackView, restack, and push stacks of pull requests and their local branchesorigin stack restack
labelManage the labels a repository definesorigin label list
rulesetManage Origin rulesets (merge-time and push-time). Alias: rsorigin ruleset list
namespaceManage access to an Origin namespace. Alias: nsorigin namespace access list acme
appManage Origin apps, their signing keys, and webhook deliveriesorigin app list
ssh-keyManage SSH keys registered with your Origin accountorigin ssh-key list
api <endpoint>Make an authenticated request to the Origin REST API at api.cursor.com/v1/originorigin api /repos/{owner}/{repo}
agentPrint a usage guide for AI agents, or install a skill that points agents to itorigin agent prompt
completionSet up bash or zsh tab completionorigin completion >> ~/.zshrc
updateUpdate origin to the current release on your channelorigin update
configManage configuration, including the release channelorigin config get-channel

Targeting a repository

Most commands infer the repository from the origin git remote in your current checkout. Override it with -R, --repo in org/name format, or set ORIGIN_REPO for the whole shell. -R wins over ORIGIN_REPO, which wins over the git remote:

origin pr list -R acme/checkout

Authentication

Manage your session and the git credential helper.

SubcommandDescriptionUsage
loginSign in through the browser and configure gitorigin auth login
setup-gitReconfigure the git credential helper for the Origin hostorigin auth setup-git
statusShow the current authentication method and accountorigin auth status
tokenPrint the token origin sends with requestsorigin auth token
logoutClear stored credentialsorigin auth logout
CommandOptionDescription
login--api-key <key>Sign in with an API key instead of the browser flow
login--localConfigure the credential helper in this repository's git config instead of globally
setup-git--host <host>Origin git host to configure (default: derived from CURSOR_ORIGIN_ENDPOINT)
setup-git--globalApply to the global git config (default: true)
setup-git--localApply to this repository's git config instead of the global one
status--json <fields>Output JSON with the fields you list, for example account,team,organization

The CLI uses the first credential it finds: CURSOR_AUTH_TOKEN, then CURSOR_API_KEY, then a login stored by origin auth login. origin auth status shows which one is in use. In CI, set CURSOR_AUTH_TOKEN or CURSOR_API_KEY instead of signing in.

When CURSOR_API_KEY is set and you omit --api-key, origin auth login asks Log in with this API key instead of the browser? [y/N] and defaults to the browser flow. In a non-interactive shell, such as CI, it logs in with the key and prints a notice.

origin auth login also installs the git credential helper, so git push and git pull against Origin remotes work without further setup.

Repositories

SubcommandDescriptionUsage
create <repo>Create a repositoryorigin repo create acme/checkout
create-mirrored <github-repo>Create a Cursor mirror of a GitHub repositoryorigin repo create-mirrored acme/checkout
listList the repositories your account can accessorigin repo list
view [repo]Display a repositoryorigin repo view acme/checkout
edit [repo]Change repository settingsorigin repo edit --visibility private
from-github [github-repo]Show the Origin repository that mirrors a github.com repositoryorigin repo from-github acme/checkout
verify-migration [repo]Compare a GitHub repository's settings with its Origin counterpartorigin repo verify-migration acme/checkout
clone <repo> [directory]Clone over HTTPS using your saved loginorigin repo clone acme/checkout
delete <repo>Delete a repositoryorigin repo delete acme/checkout
accessManage who can access a repository. See Repository accessorigin repo access list
mirrorManage a repository's GitHub mirror. See Mirrorsorigin repo mirror status

Pass org/name to target a repository. origin repo create <name> without a slash creates the repository in your account's namespace.

CommandOptionDescription
create--default-branch <branch>Default branch for the new repository (server default: main)
create-mirrored--namespace <namespace>Namespace to create the mirror under (default: your account's namespace)
create-mirrored--github-enterprise-id <uuid>GitHub Enterprise Server app UUID. Omit it when mirroring from github.com
list--namespace <namespace>List one namespace instead of every namespace you can access
list--json <fields>Output JSON with the fields you list, for example org,name,mirrorStatus
view--json <fields>Output JSON with the fields you list, for example org,name,defaultBranch
edit--default-branch <branch>Set the default branch
edit--visibility <visibility>Set the visibility: internal or private
edit--allow-merge-commitAllow merge commits. --no-allow-merge-commit disallows them
edit--allow-squash-mergeAllow squash merges. --no-allow-squash-merge disallows them
edit--delete-branch-on-mergeDelete the head branch when a pull request merges. --no-delete-branch-on-merge keeps it
edit--json <fields>Output JSON with the fields you list
from-github--json <fields>Output JSON with the fields you list, for example found,org,name,sourceOfTruth
verify-migration--github-repo <owner/repo>GitHub counterpart (default: resolved from the Origin repository's mirror info)
verify-migration--namespace <namespace>Verify every repository in a namespace
verify-migration--github-input <file>Read captured GitHub settings from a JSON file instead of calling gh api. Use - for stdin
verify-migration--json <fields>Output JSON with the fields you list
delete-y, --yesSkip the confirmation prompt. Required in a non-interactive shell

origin repo from-github takes owner/repo, HOST/OWNER/REPO, or a URL. Without an argument, it reads the origin remote when that remote points at github.com.

origin repo view --json mirrorStatus tells you which forge owns a repository. no-mirror and outbound mean Origin owns it. Any other value means GitHub does. See Mirror a GitHub repo.

Repository access

origin repo access manages who can reach a repository: the owning team's groups, team members, organization groups, and external collaborators.

SubcommandDescriptionUsage
listList every access grant on the repositoryorigin repo access list
setGrant or change a roleorigin repo access set --user dana@acme.com --role Write
removeRemove a direct grantorigin repo access remove --user dana@acme.com
policiesList the roles you can grant, which are the valid --role valuesorigin repo access policies

set and remove take exactly one subject:

OptionDescription
--team <group>The owning team's admins or members group. On remove, clears the per-repository override
--user <user>A team member, by numeric Cursor user ID or the email of an existing grantee
--group <group>An organization group, by ID or the display name of an existing grantee
--external <user>An external collaborator, by numeric Cursor user ID or the email of an existing collaborator
CommandOptionDescription
set--role <role>Role to grant, by display name (Read, Write, Admin) or policy name (ORIGIN_REPO_READ). none removes the grant. Required
list--search <text>Filter grants and collaborators by name or email
all--json <fields>Output JSON with the fields you list

Removing a repository grant leaves namespace-level grants alone. To change those, use origin namespace access.

Mirrors

origin repo mirror manages a repository's GitHub mirror.

SubcommandDescriptionUsage
statusShow the mirror status and any transition joborigin repo mirror status
syncFetch a ref from GitHub into an inbound mirror noworigin repo mirror sync --ref main --wait
detachPermanently disconnect the repository from GitHub, so it becomes Origin-onlyorigin repo mirror detach
CommandOptionDescription
status--job <id>Show a specific transition job instead of the active one
status--watchPoll until the transition job succeeds, fails and rolls back, or is superseded
sync--ref <ref>Branch name or full ref to sync (default: the default branch)
sync--waitBlock until the ref syncs or the server's wait budget runs out
sync--sha <sha>Full commit SHA to wait for. Returns once it's reachable from the ref
detach-y, --yesSkip the confirmation prompt
all--json <fields>Output JSON with the fields you list

Push local

On a repository mirrored from GitHub, origin push local sets up the origin-local remote at https://origin.cursor.com/{owner}/{repo}.git/local and pushes local origin/* branches there. Use this to keep working when GitHub is unavailable, or to store any other git state you want only on the Origin copy. It doesn't appear in origin --help. After the first run, that remote looks like:

origin-local    https://origin.cursor.com/{owner}/{repo}.git/local (fetch)origin-local    https://origin.cursor.com/{owner}/{repo}.git/local (push)

Other branches still go to GitHub with git push origin. See forge-local branches.

SubcommandDescriptionUsage
localSet up the origin-local remote and push origin/* branchesorigin push local
OptionDescription
--remote <name>Git remote to create or update (default: origin-local). Cannot be origin or github
--dry-runShow what would be pushed without pushing

Labels

Manage the labels a repository defines. Add them to pull requests with origin pr create --label or origin pr edit --add-label.

SubcommandDescriptionUsage
listList the repository's labelsorigin label list
create <name>Create a labelorigin label create bug -c d73a4a
edit <label>Change a label's name, color, or descriptionorigin label edit bug -n defect
delete <name>Delete a labelorigin label delete defect
import <input>Import labels from a JSON file, or - for stdingh label list --json name,color,description | origin label import -
CommandOptionDescription
list-S, --search <text>Search label names
list-L, --limit <number>Maximum number of labels to fetch (default: 30)
create-c, --color <hex>Six-character hex color, with or without a leading # (default: random)
create-d, --description <text>Label description
create-f, --forceUpdate the color and description when the label already exists
edit-n, --name <name>New name
edit-c, --color <hex>New color
edit-d, --description <text>New description
delete-y, --yesSkip the confirmation prompt
import-f, --forceUpdate labels that already exist instead of skipping them
import--dry-runPrint what would be imported without writing anything
all--json <fields>Output JSON with the fields you list

origin label import reads the output of gh label list --json name,color,description, so you can copy a GitHub repository's labels in one step.

Rulesets

Manage the merge-time and push-time rulesets for a repository:

SubcommandDescriptionUsage
listList the repository's rulesetsorigin ruleset list
view <ruleset-id>View a ruleset by ID, as printed by origin ruleset list. Alias: getorigin ruleset view <id>
createCreate a ruleset from flags or a JSON specorigin ruleset create --input ruleset.json
update <ruleset-id>Update a ruleset from flags or a JSON specorigin ruleset update <id> --enforcement active
delete <ruleset-id>Delete a rulesetorigin ruleset delete <id>
importCreate rulesets from GitHub ruleset or branch-protection JSONorigin ruleset import --from-github rules.json

create and update take these options. Each repeatable option replaces the whole list:

OptionDescription
--name <name>Ruleset display name
--description <text>Ruleset description
--enforcement <mode>active, evaluate, or disabled
--kind <kind>merge_branch, push_branch, push_tag, or push_repository
--included-ref <pattern>Ref pattern the ruleset applies to, such as ~DEFAULT_BRANCH or refs/heads/release/*. Repeatable
--excluded-ref <pattern>Ref pattern to exclude. Repeatable
--rule <rule>A rule as <rule_type>[=<json parameters>], such as 'pull_request={"requiredApprovingReviewCount":1}'. Repeatable
--bypass-actor <json>A bypass actor as a JSON object with bypassMode, actorKind, and optional actorPayload. Repeatable
--input <file>JSON spec file, or - for stdin. Accepts origin ruleset view --json output. Flags override fields from the spec
CommandOptionDescription
import--from-github <file>GitHub JSON: one ruleset, an array of rulesets, or classic branch protection. Use --from-github=- for stdin. Required
import--branch <pattern>Branch or pattern a classic branch-protection payload applies to. Required for that input
import--enforcement <mode>Override enforcement on every imported ruleset, for example evaluate to trial them first
import--dry-runPrint the rulesets that would be created without writing them
delete-y, --yesSkip the confirmation prompt
all--json <fields>Output JSON with the fields you list

To copy a ruleset between repositories, save origin ruleset view <id> --json name,enforcement,kind,includedRefNames,excludedRefNames,rules,bypassActors to a file and pass it to origin ruleset create --input with -R set to the target repository.

Namespaces

origin namespace access manages grants on a namespace, the org in org/repo. origin ns is an alias for origin namespace.

SubcommandDescriptionUsage
list <namespace>List the team groups and individual grantsorigin namespace access list acme
set <namespace>Grant a role to a team group, a user, or an organization grouporigin namespace access set acme --user dana@acme.com --role Admin
remove <namespace>Remove a grant. Alias: rmorigin namespace access remove acme --user dana@acme.com
policies <namespace>List the roles you can grant, which are the valid --role valuesorigin namespace access policies acme

set and remove take exactly one of --team <admins|members>, --user <user> (a Cursor user ID, or the email of a user already granted on the namespace), or --group <id> (an organization group ID, as printed by list).

CommandOptionDescription
set--role <role>Role to grant, by policy name (ORIGIN_NAMESPACE_ADMIN) or display name (Admin). Required
set, remove--retain-self-adminWhen the change would remove the last Codebase Admin, keep you as admin through a personal grant instead of failing
remove-y, --yesSkip the confirmation prompt
list--search <text>Filter individual grants by name or email
all--json <fields>Output JSON with the fields you list

Apps

origin app manages Origin apps: their webhook subscriptions, signing keys, and webhook deliveries.

SubcommandDescriptionUsage
listList the apps a namespace publishesorigin app list
view <app-id>View an app's configuration, stats, and signing keysorigin app view <app-id>
createCreate an app in a namespace you administerorigin app create --name ci-bot --generate-key ci-bot.pem
edit <app-id>Edit an app. Options you omit leave fields unchangedorigin app edit <app-id> --event pull_request.merged
key add <app-id> <key-file>Add an Ed25519 public key (PEM SPKI). Use - for stdinorigin app key add <app-id> key.pub
key revoke <app-id> <kid>Revoke a signing key by key ID, as printed by origin app vieworigin app key revoke <app-id> <kid>
webhook deliveriesList webhook deliveries and their outcomesorigin app webhook deliveries --no-delivered
webhook redeliver <delivery-ids...>Queue deliveries to send againorigin app webhook redeliver <delivery-id>
webhook pingSend a signed test ping event and report the responseorigin app webhook ping
CommandOptionDescription
list--namespace <namespace>Namespace whose apps to list (default: inferred from your account)
list-L, --limit <number>Maximum number of apps to list (default: 100)
create--name <name>App display name. Required
create--namespace <namespace>Owning namespace (default: inferred from your account)
create--public-key <file>Ed25519 public key (PEM SPKI) for the app signing key. Use - for stdin
create--generate-key <path>Generate an Ed25519 key pair, write the private key (PKCS#8 PEM) to this path, and register the public key
create, edit--webhook-url <url>HTTPS URL that receives webhook events. On edit, "" clears the webhook configuration
create, edit--event <event>Webhook event subscription, such as pull_request.created. Repeatable. On edit, replaces the list
create, edit--redirect-uri <uri>Allowed OAuth install callback (absolute HTTPS URI). Repeatable. On edit, replaces the list
create, edit--default-scope <scope>Default scope the app declares, such as repository:contents:read. Repeatable. On edit, replaces the list
create, edit--description <text>Short app description. On edit, "" clears it
create, edit--website-url <url>Publisher website (absolute HTTPS URL). On edit, "" clears it
edit--name <name>New display name
edit--clear-eventsRemove every event subscription
edit--clear-redirect-urisRemove every install callback
edit--clear-default-scopesRemove every default scope
webhook *--app <app-id>App to authenticate as. Requires --signing-key
webhook *--signing-key <file>The app's private signing key (Ed25519 PKCS#8 PEM)
deliveries--deliveredOnly deliveries the receiver acknowledged. --no-delivered lists every delivery that never got a 2xx response
deliveries--event-type <event>Only this event type, such as pull_request.created
deliveries--installation <id>Only this installation
deliveries-L, --limit <number>Maximum number of deliveries to list (default: 30)
all except key--json <fields>Output JSON with the fields you list

Redelivery is asynchronous. Run origin app webhook deliveries afterward to see the outcome.

SSH keys

Manage the SSH public keys on your Origin account:

SubcommandDescriptionUsage
add [key-file]Add an SSH public key to your account. -t, --title is required and names the key. Omit the file or pass - to read stdinorigin ssh-key add ~/.ssh/id_ed25519.pub -t work-laptop
listList the SSH public keys on your account (--json <fields> for JSON)origin ssh-key list
delete <id>Delete a key by ID, as printed by origin ssh-key list. -y, --yes skips the promptorigin ssh-key delete <id>

API requests

origin api makes an authenticated request to the Origin REST API at api.cursor.com/v1/origin for anything without a first-class command. It supports request flags similar to gh api: -X, --method, -H, --header, -F, --field, -f, --raw-field, and --input. --verbose prints the request and response headers to stderr, and --silent drops the response body. To filter the JSON response, pipe it to jq. {owner}, {repo}, and {branch} placeholders expand from -R, --repo, the ORIGIN_REPO environment variable, or the origin git remote. See the Origin API docs for endpoints, authentication, and examples.

Agents

origin agent prompt prints a Markdown guide to origin for AI agents, written for the installed version. origin agent prompt <topic> prints one topic: auth, prs, review, ci, stacking, json, or reference. origin agent prompt reference pr lists every command in one group.

origin agent setup installs a skill that tells your coding agent to run origin agent prompt:

OptionDescription
--harness <agent>Agent to install the skill for: cursor, claude-code, or codex
--globalInstall in your home directory, for every project (default: true)
--projectInstall in the current project instead (cursor and claude-code)
--printPrint the skill instead of writing it, to install it for another agent

Updates

Update to the current release on your channel:

origin update

--force reinstalls even when you're already on the current version.

The CLI updates from the stable channel by default. Switch with origin config set-channel <latest|stable> and check with origin config get-channel.

Shell completion

Append the completion script to your shell config:

origin completion >> ~/.zshrc

Branch-valued flags such as --head and --base then complete local branch names.

Environment variables

VariableDescription
CURSOR_AUTH_TOKENCursor auth token, used directly as a bearer token. Takes precedence over every other credential
CURSOR_API_KEYAPI key, exchanged for a session and never stored. Used when CURSOR_AUTH_TOKEN is unset. origin auth login asks before using it in an interactive shell
CURSOR_ORIGIN_ENDPOINTAPI server endpoint (default: https://api.origin.cursor.com)
ORIGIN_REPODefault repository in org/name format when you omit -R, --repo
NO_COLORTurn off colored output

Getting help

Every command takes --help:

origin --helporigin repo --helporigin repo create --help

Next steps