mcpField
O
origin-api

origin-api

github.com/cursorDevelopment14.5k363 installsUpdated today
Repository

About origin-api

A documentation-guidance skill for developers working with the Cursor Origin API. It directs readers to the relevant API contract and docs, and highlights rules for repository types, event subscriptions, webhook verification, scopes, and opaque identifiers.

Key features

  1. 01Locate relevant API documentation
  2. 02Check native and mirrored repository limits
  3. 03Review event subscription requirements
  4. 04Verify and deduplicate webhook deliveries
  5. 05Derive scopes from the API specification
  6. 06Treat tokens and IDs as opaque

Use cases

  1. 01Finding the contract for a specific API question
  2. 02Checking webhook handling before implementation
  3. 03Determining required scopes for app operations
  4. 04Reviewing behavior when porting an integration

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/cursor/plugins --skill origin-api

After installing, type/origin-apiin Claude Code to confirm it loaded.

Details

From the project README

Origin API

The docs are the source of truth. Do not name an endpoint, scope, event slug, header, or limit from memory. Where this file and the docs disagree, the docs win.

The docs live under https://cursor.com/docs/api/origin/. llms.txt is the index and links every section, endpoint, and webhook payload. openapi.yaml is the contract, and "Endpoint reference" explains its x-origin-* extensions. llms-full.txt is the whole reference in one file. changelog says what moved. For one question, start at llms.txt and fetch only the section that answers it. llms-full.txt and openapi.yaml are each several hundred kilobytes, too large to read into context whole. When you need all of them, as a porting brief does, save them locally if you can, outside any repository you are working in, search them for the section heading or annotation you need, and read only the matching part. Cite operationIds and section names.

Rules to check first

  1. Native or mirror. A repository is either native (created on Origin) or a GitHub mirror. On a native repository an installation has its full scopes and every write. On a GitHub mirror, every event except repository.pushed still arrives, every call beyond metadata and contents reads returns 403, and merging a pull request or changing the default branch is not available ("Mirrored repositories", "Events").
  2. Subscribe. Only installation.* events arrive without a subscription. A missing subscription produces silence, not an error ("Events").
  3. Verify, dedupe, acknowledge. Verify the signature over the raw body before parsing, dedupe on the delivery ID, return 2xx, then process ("Signature verification", "Retries", "Automatic disable"). Origin signs a digest, which Standard Webhooks does not, so a generic verifier fails.
  4. Scopes from the spec. Request the union of x-origin-scopes.scopes over the operations the app calls ("Scopes").
  5. Opaque tokens and IDs. Do not build or parse page tokens or IDs ("Pagination", "IDs").

One section name the index does not make obvious: what happens to a check-run post that arrives out of order is under "Ordering writes".

Porting an existing GitHub App: use port-github-app-to-origin in this plugin.

Comments

Markdown supported