About checkmarx
Checkmarx provides an MCP server that connects AI coding assistants to Checkmarx One for security scans, findings, project management, and AI-generated remediation. This repository also includes client-specific Developer Assist plugins that scan file writes before they reach disk.
Key features
- 01Scan projects and inspect findings
- 02Apply AI-generated remediation
- 03Manage Checkmarx One projects
- 04Gate scannable file writes with scans
- 05Support plugins for multiple coding clients
Use cases
- 01Scan code from an MCP-capable assistant
- 02Review vulnerabilities during code generation
- 03Block vulnerable file edits before they reach disk
MCP support
The hosted MCP server exposes Checkmarx One scanning, findings, project management, and remediation tools to MCP clients. Developer Assist plugins also start the same server for remediation.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}claude mcp add --transport http com-checkmarx-checkmarx https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}{"mcpServers":{"com-checkmarx-checkmarx":{"type":"http","url":"https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}"}}}Open in Cursor{"servers":{"com-checkmarx-checkmarx":{"type":"http","url":"https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}"}}}Open in VS Code{"mcpServers":{"com-checkmarx-checkmarx":{"type":"http","url":"https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}"}}}{"mcpServers":{"com-checkmarx-checkmarx":{"serverUrl":"https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
Details
From the project README
Checkmarx Agentic AI
Checkmarx application security, built for AI coding agents.
Table of Contents
Overview
AI coding assistants generate code quickly, but that code can carry the same security risks as code written by hand. This repository connects Checkmarx One — Checkmarx's application security platform — to those assistants, so generated code is scanned for vulnerabilities as it's written, not after the fact.
This repository ships two complementary ways to bring Checkmarx One into an AI-assisted workflow. Use them together or separately — they solve different halves of the problem.
- Checkmarx Security MCP — a hosted MCP server any MCP-capable assistant can call to scan, inspect findings, and apply AI remediation on demand.
- Developer Assist plugins — fail-closed gates that scan scannable file writes before they land on disk, for Claude Code, Cursor, GitHub Copilot CLI, Codex CLI, and Gemini CLI.
| Piece | What it does | When to use it |
|---|---|---|
| Checkmarx Security MCP | Tools the assistant can call — scan a project, inspect findings, apply AI remediation | You want on-demand scanning and fix-it workflows in any MCP client |
| Developer Assist plugins | A fail-closed gate — scannable file writes are scanned before they land on disk | You want the check to be automatic and non-optional |
The plugins wrap the Checkmarx One CLI (ast-cli) (cx) for install, authentication, and native hook scanning, and they start the same MCP server for remediation.
Checkmarx Security MCP
A hosted MCP server that connects any MCP-capable AI client — Claude, Cursor, Copilot, Windsurf, Kiro — to Checkmarx One. It exposes scanning, findings, project management, and AI-generated remediation as tools your assistant can call in conversation.
Configure it once (see examples/ for per-client config) and ask.
Details → README-MCP.md
Cursor: MCP-only install
plugins/cx-cursor-plugin is a lightweight Cursor marketplace plugin that registers the Checkmarx MCP server only — no hook chain, no file-write gate, just the MCP tools. Use it when you want Checkmarx MCP tools in Cursor without adopting the Developer Assist gate.
Details → plugins/cx-cursor-plugin/README.md
Developer Assist Plugins
Each plugin provides the same fail-closed security gate, wired in as a native hook for its client. Before the agent writes or edits a scannable file, the Checkmarx cx CLI scans the proposed content — real vulnerabilities are blocked rather than silently allowed, as is the case where the scanner itself can't be trusted to run. Shell commands are never gated. Findings are remediated through the bundled Checkmarx MCP server. Marketplace install and guided cx setup follow the same pattern across clients; only the client integration differs.
| Plugin | Client | Details |
|---|---|---|
cx-devassist | Claude Code | plugins/cx-devassist/README.md |
cursor-devassist | Cursor | plugins/cursor-devassist/README.md |
copilot-devassist | GitHub Copilot CLI | plugins/copilot-devassist/README.md |
codex-devassist | Codex CLI | plugins/codex-devassist/README.md |
| Root extension | Gemini CLI | docs/gemini-cli-devassist.md |
Checkmarx One CLI
The plugins install and drive the Checkmarx One CLI (cx) from Checkmarx/ast-cli. That CLI wraps Checkmarx One APIs for scans, authentication, and the native agent-hook scanners (ASCA, KICS, SCA).
Releases and platform downloads: ast-cli releases.
Documentation: Checkmarx One CLI tool.
Documentation
- README-MCP.md — MCP server overview, auth, and client config
- docs/usage.md — MCP tool catalog and example workflows
- docs/authentication.md — API key and OAuth2 setup
- docs/troubleshooting.md — connection, auth, and scan issues
- docs/gemini-cli-devassist.md — Gemini CLI extension install, hooks, and skills
- CONTRIBUTING.md — how to contribute
Contributing
We appreciate feedback and contributions. Before you get started, please see:
- Checkmarx contribution guidelines
- Code of Conduct
- SECURITY.md — report a vulnerability
License
Distributed under the Apache 2.0 license. It governs everything in this repository, including the MCP server and all plugins.
Feedback
We'd love to hear your feedback! If you come across a bug or have a feature request, please let us know by submitting an issue in GitHub Issues.
Contact
Checkmarx One Integrations Team
Project Link: https://github.com/Checkmarx/cx-agentic-ai.
Website: Checkmarx.
© 2026 Checkmarx Ltd. All Rights Reserved.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.