Case Study #7
Claude Code vs Cursor: two projects, each reviewed twice.
9 October 2026 note. Prices and models at the time of writing; see /pricing for current.
We ran two real builds through two different IDEs. Claude Code built an AI Email Drafter. Cursor built a PR Description Drafter. In both runs we set the IDE's own review beside a MegaLens review. These are two runs, and the counts below come from those runs only.
2
Projects tested
2
IDEs compared
60
MegaLens findings, both projects
7
Found by one reviewer alone
Two real projects, two IDEs
These aren't demo apps or staged tests. Both are real tools we built and use. Each one went through the same process: the IDE wrote the plan, reviewed its own plan, then MegaLens reviewed the same plan independently.
AI Email Drafter
A backend service that polls Gmail, identifies real business inquiries, and creates draft replies from a context file. Never sends email. Claude Code wrote the 19-section build plan and built the entire tool.
2
Solo review
15
MegaLens
12
Not on Claude's list
PR Description Drafter
A self-hosted git daemon that watches local branches, reads diffs and commit messages, generates PR descriptions via AI, and creates draft pull requests on GitHub. Cursor Agent wrote the 493-line V1 engineering plan.
23
Solo review
45
MegaLens
22 more
45 vs 23
What the two runs showed
The numbers are different because the projects are different. In both runs, the IDE's solo review did solid work and caught real issues, and the MegaLens review returned further findings: 12 items not on Claude Code's own list, and 45 findings to Cursor's 23.
| Claude Code AI Email Drafter (run 2) | Cursor PR Drafter | |
|---|---|---|
| IDE’s own review | 12 items | 23 findings |
| MegaLens review | 15 findings | 45 findings |
| Difference | 12 of the 15 not on Claude’s list (3 overlapped) | 22 more findings (45 vs 23) |
| Critical findings | 2 in MegaLens’s 15, both new | went from 3 to 7 |
| Provider cost, own key | not recorded | $0.22 |
| MegaLens time | not recorded | 7 min |
$0.22 is what the providers charged on our own key for the Cursor run. The Claude Code run's provider cost and time were not recorded. Its plan review was priced at $1.25 and its mid-build code review at $1.23 on pay as you go at the time, both printed in the session. The Cursor run's pay-as-you-go price was not recorded.
Run 1 of the same project, with Claude Code's own pre-audit, is documented here.
The Claude Code review was a quick self-audit (12 short items), while the Cursor review was a full prompted security pass (23 items). On the same plan, MegaLens returned 45 findings to Cursor's 23. The ceiling isn't about effort. It's about having one model review from one perspective.
What MegaLens found on the PR Drafter
45 findings against Cursor's 23. Here are the ones that matter most.
Found by one reviewer only(The other reviewers did not raise these.)
The tool runs git commands against user repositories. But Git has built-in extension points: custom diff tools, credential helpers, and aliases defined in .gitconfig. A repository with a malicious .gitconfig would execute arbitrary code every time the daemon runs "git diff" or "git log". This is a real Git feature, not a bug. The other reviewers and Cursor did not raise it.
The plan uses a fixed port (8765) for the OAuth callback. Any other program on the same machine can bind that port first and steal the GitHub authorization code.
When the daemon runs "git fetch", Git can invoke SSH with ProxyCommand or custom transport protocols. Without restricting allowed transports, a malicious remote can trigger code execution.
Also found by one reviewer only
YAML config can execute code if parsed with an unsafe loader (one reviewer only)
Git commands with no timeout or output limit. Huge repo = out of memory (one reviewer only)
Config reload via signal accepts new paths without validation (one reviewer only)
State file paths can be manipulated via symlinks (one reviewer only)
Found by more than one model
Force-push breaks state tracking: duplicate PRs or retry loops
No spending cap on AI API calls
Single GitHub token used across all repos
Race condition: two changes create duplicate PRs
Branch-to-remote mapping can target wrong repository
What Claude Code missed on the Email Drafter
13 findings that MegaLens added beyond Claude Code's own review. Two were critical.
The plan had a daily spending cap but no code to actually parse costs from the API response. The cap existed on paper only.
On database loss, the tool would process every unread email in the inbox. Dozens of unwanted drafts and a surprise API bill.
Email headers passed raw into AI prompt (injection vector)
Draft-create race condition: duplicate drafts on crash
No MIME parsing spec for multipart, HTML, charset
Reply envelope headers undefined (To, Cc, In-Reply-To)
Poison messages retry forever with no quarantine
systemd Environment= exposes API keys in /proc
Gmail historyId 7-day expiry unhandled
Why a separate reviewer
Models notice different things.
Each model was trained on different data with different priorities, so different models tend to notice different things.
Writing and reviewing are different jobs.
When the model that wrote a plan also reviews it, it is checking its own work. That is true of any IDE.
Reviewers from other companies, then a judge.
MegaLens selects up to four AI models from different companies to review your code. A judge checks each finding against the code and marks it verified only when it can quote the code that proves it.
How MegaLens fits in
MegaLens is an MCP server. You install it once, and it becomes a tool your IDE can call. It works with Claude Code, Codex CLI, Cursor, Gemini CLI and Lovable, and with any tool that supports OAuth MCP connectors, such as ChatGPT and Claude.ai. GitHub Copilot is coming soon. You don't leave your IDE.
Add MegaLens to Claude Code, Codex CLI, Cursor, Gemini CLI or Lovable, or add it as an OAuth connector in ChatGPT or Claude.ai.
Ask your IDE to run megalens_debate on your code or plan.
MegaLens selects up to four AI models from different companies. Each one reviews on its own.
A judge checks each finding against the code. A finding is verified only when the judge can quote the code that proves it.
Structured findings arrive in your IDE. Each result names the models that actually took part. MegaLens reviews. Your IDE decides what to change.
Honest notes
The two projects are different in size and complexity, so the raw numbers aren't directly comparable. In both runs, the IDE's own review found a solid base, and the MegaLens review returned further findings.
The Claude Code test was a quick self-audit (12 short items), while the Cursor test was a full prompted security review (23 items). On the Cursor plan, MegaLens returned 45 findings to Cursor's 23.
MegaLens produces findings, not proofs. Every finding required human judgment to confirm and decide on a fix. These are two tests on two projects. Your results will depend on what you're reviewing and how thorough your existing process is.
What this actually means for your workflow
Two projects. Two IDEs. In both runs, the MegaLens review returned findings that were not in the IDE's own review. Claude Code's own list missed 12 of MegaLens's 15 findings on the Email Drafter. On the PR Drafter, MegaLens returned 45 findings to Cursor's 23. Two runs do not show that this holds on other projects.
MegaLens selects up to four AI models from different companies to review your code. Their findings come back into the IDE you already use. MegaLens reviews. Your IDE decides what to change.
Two critical findings in the Email Drafter were about things that existed only on paper: a cost cap with no implementation and a fresh-install bug that would flood inboxes. These are the kinds of gaps that don't surface until production.
Add reviewers from other AI companies to your IDE.
Works with Claude Code, Codex CLI, Cursor, Gemini CLI and Lovable, and with OAuth connectors such as ChatGPT and Claude.ai. GitHub Copilot is coming soon. MegaLens reviews. Your IDE decides what to change.