Cursor
.cursorrules · .cursor/rules/**/*.mdcIDE Rule Sync
One ruleset for every reviewer.
You already maintain rule files for your IDE assistant — Cursor, Copilot, Claude, Windsurf, and more. Mesrai imports them automatically, so cloud PR reviews and the CLI enforce the exact same policy your local assistant does.
Cursor·Copilot·Claude·Windsurf·Cody
MESRAI
Mesrai
@mesraiofficialFREEmesraiofficial
Reviews: 8993 / 100000
Review completed
UncommittedCurrent FileUnpushedStaged
1 files · 7 findings · 39s · 338 tokens
AI SuggestionsStatic Analysis
login.tsx7
HIGHsecurity
URL parameter injection vulnerability
The code directly uses URL search parameters without sanitization, which could lead to XSS attacks.
Suggested Fix: Sanitize the error message before displaying it.
BEFORE
398
const errorMessage = searchParams.get("error");AFTER
398
const errorMessage = DOMPurify.sanitize( searchParams.get('error') ?? '');security · L398 · 72% confidence
Go to line 398
2 / 7
package.json
README.md
login.tsx 5
apps > web > src > pages > login.tsx > …
394const AuthSection = memo(() => {
395 const [mounted, setMounted] = useState(false);
396 const searchString = useSearch();
397 const searchParams = new URLSearchParams(searchString);
398 const errorMessage = searchParams.get("error");
High: Security
Mesrainow High
● High — URL parameter injection vulnerability
Uses URL search parameters without sanitization. Could lead to XSS attacks.
Suggested Fix: Sanitize the error message before displaying.
Before:
searchParams.get("error")
After:
DOMPurify.sanitize(…)
399 const [showError, setShowError] = useState(!!errorMessage);
400
401 useEffect(() => {
402 setMounted(true);
403 }, []);
PROBLEMS 6OUTPUTTERMINALCOMMENTS 7
Mesrai now ·Medium — Missing Content Security Policy headers[Ln 34-37]
Mesrai now ·Medium — Potential XSS in dynamic class concatenation[Ln 88]
Mesrai now ·Medium — Potential SSR hydration mismatch[Ln 394-414]
mesrai-cde-develop-v1*⊘ 2 ⚠ 3 ⓘ 1
Mesrai (7)TypeScript JSXUTF-8
Supported sources
9 toolsGitHub Copilot
.github/copilot-instructions.md · .github/instructions/**Claude
CLAUDE.md · .claude/settings.jsonWindsurf
.windsurfrulesSourcegraph Cody
.sourcegraph/**/*.rule.mdOpenCode
.opencode.jsonAider
.aider.conf.yml · .aiderignoreAgentic
.agents.md · .agent.mdGeneric / repo
.rules/** · docs/coding-standards/**How sync works
4 steps01
Mesrai scans your repo
On install, Mesrai detects existing rule files for any supported tool — Cursor, Copilot, Claude, and the rest.
02
Each file becomes a Mesrai Rule
Parsed into the same Mesrai Rules format you use in the dashboard. Editable, taggable, audit-tracked.
03
Auto-sync on every push
When the rule file changes upstream, Mesrai re-syncs and the cloud reviewer + CLI pick up the new policy.
04
One source of truth
Your IDE assistant + Mesrai cloud reviewer + Mesrai CLI all use the exact same rules. No drift between local and remote review.
?Frequently asked
6 questionsWhich IDEs and AI coding assistants does Mesrai sync with?+
Cursor (`.cursorrules`, `.cursor/rules/`), GitHub Copilot (`.github/copilot-instructions.md`), Claude Code (`CLAUDE.md`, `.claude/`), Windsurf (`.windsurfrules`), Cody (`cody-rules.yaml`), OpenCode (`opencode.json`), Aider (`.aider.conf.yml`), and Agentic (`AGENTS.md`). Mesrai reads whichever rule files already exist in the repo — no migration needed.
How does rule sync actually work?+
On first install Mesrai scans the repo for any of the supported rule files, parses them into a normalised Mesrai Rules format, and shows you a one-screen import preview. You approve which rules to bring in; rejected ones are ignored. After that the cloud reviewer applies the same rules on every PR — your IDE and the cloud now agree on what 'good' looks like.
Will syncing overwrite my existing .cursorrules or CLAUDE.md files?+
No. Sync is read-only by default — Mesrai never modifies the source rule files in your repo. Two-way sync (cloud rule changes flowing back to your IDE files) is an opt-in setting per repository, off by default.
Do I have to install an extension or plugin in my IDE?+
No. The sync runs entirely off the rule files already committed in the repository — those files are what your IDE reads. There's no Mesrai extension to install. If you want IDE-side suggestions, your existing AI assistant (Cursor, Copilot, etc.) keeps doing that job using the same rule files Mesrai reads.
Can I write rules in YAML instead of plain English?+
Yes. Mesrai Rules accept three formats: plain English (recommended for most rules), YAML (structured triggers + remediation), or a hybrid Markdown-with-frontmatter format. Each is converted to the same internal representation. Pick whatever your team already uses — Mesrai doesn't force a format.
Does rule sync work both ways (IDE → cloud AND cloud → IDE)?+
By default it's one-way: IDE rule files are imported into Mesrai cloud. Two-way sync (cloud → IDE) is an opt-in flag — when a rule is added or edited in the Mesrai web app, Mesrai opens a PR back to your repo with the updated rule file. Useful for centralised rule management; off by default to avoid surprising the team with bot PRs.
Sync
Already have rules? Bring them.
Mesrai imports your existing rule files in seconds. No rewrites, no migration.