Search DevTools

Jump to any tool or page

checkmarx

Official Checkmarx MCP Server

Checkmarx0 stars2 forksAI & Agents
View source

Install

mcp_config.json

{
  "mcpServers": {
    "com-checkmarx-checkmarx": {
      "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}",
      "type": "streamable-http"
    }
  }
}

Documentation

Checkmarx Agentic AI Checkmarx application security, built for AI coding agents.

Report Bug
·
Request Feature

Table of Contents

Overview
Checkmarx Security MCP
Developer Assist Plugins
Checkmarx One CLI
Documentation
Contributing
License
Feedback
Contact

Overview

AI coding assistants generate code quickly, but that code can carry the same security risks as code written by hand. This repository connects Checkmarx One — Checkmarx's application security platform — to those assistants, so generated code is scanned for vulnerabilities as it's written, not after the fact.

This repository ships two complementary ways to bring Checkmarx One into an AI-assisted workflow. Use them together or separately — they solve different halves of the problem.

  • Checkmarx Security MCP — a hosted MCP server any MCP-capable assistant can call to scan, inspect findings, and apply AI remediation on demand.
  • Developer Assist plugins — fail-closed gates that scan scannable file writes before they land on disk, for Claude Code, Cursor, GitHub Copilot CLI, Codex CLI, and Gemini CLI.
PieceWhat it doesWhen to use it
Checkmarx Security MCPTools the assistant can call — scan a project, inspect findings, apply AI remediationYou want on-demand scanning and fix-it workflows in any MCP client
Developer Assist pluginsA fail-closed gate — scannable file writes are scanned before they land on diskYou want the check to be automatic and non-optional

The plugins wrap the Checkmarx One CLI (ast-cli) (cx) for install, authentication, and native hook scanning, and they start the same MCP server for remediation.

Checkmarx Security MCP

A hosted MCP server that connects any MCP-capable AI client — Claude, Cursor, Copilot, Windsurf, Kiro — to Checkmarx One. It exposes scanning, findings, project management, and AI-generated remediation as tools your assistant can call in conversation.

Configure it once (see examples/ for per-client config) and ask.

Details → README-MCP.md

Cursor: MCP-only install

plugins/cx-cursor-plugin is a lightweight Cursor marketplace plugin that registers the Checkmarx MCP server only — no hook chain, no file-write gate, just the MCP tools. Use it when you want Checkmarx MCP tools in Cursor without adopting the Developer Assist gate.

Details → plugins/cx-cursor-plugin/README.md

Developer Assist Plugins

Each plugin provides the same fail-closed security gate, wired in as a native hook for its client. Before the agent writes or edits a scannable file, the Checkmarx cx CLI scans the proposed content — real vulnerabilities are blocked rather than silently allowed, as is the case where the scanner itself can't be trusted to run. Shell commands are never gated. Findings are remediated through the bundled Checkmarx MCP server. Marketplace install and guided cx setup follow the same pattern across clients; only the client integration differs.

PluginClientDetails
cx-devassistClaude Codeplugins/cx-devassist/README.md
cursor-devassistCursorplugins/cursor-devassist/README.md
copilot-devassistGitHub Copilot CLIplugins/copilot-devassist/README.md
codex-devassistCodex CLIplugins/codex-devassist/README.md
Root extensionGemini CLIdocs/gemini-cli-devassist.md

Checkmarx One CLI

The plugins install and drive the Checkmarx One CLI (cx) from Checkmarx/ast-cli. That CLI wraps Checkmarx One APIs for scans, authentication, and the native agent-hook scanners (ASCA, KICS, SCA).

Releases and platform downloads: ast-cli releases.

Documentation: Checkmarx One CLI tool.

Documentation

Contributing

We appreciate feedback and contributions. Before you get started, please see:

License

Distributed under the Apache 2.0 license. It governs everything in this repository, including the MCP server and all plugins.

Feedback

We'd love to hear your feedback! If you come across a bug or have a feature request, please let us know by submitting an issue in GitHub Issues.

Contact

Checkmarx One Integrations Team

Project Link: https://github.com/Checkmarx/cx-agentic-ai.

Website: Checkmarx.

© 2026 Checkmarx Ltd. All Rights Reserved.

Sourced from the repository README.

More in AI & Agents