Checkmarx

com.checkmarxPublished by checkmarx.comv1.0.0Updated Oct 24, 2026

Official Checkmarx MCP Server

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring

Server details

Identifier: com.checkmarx/checkmarx
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to checkmarx.com, but the endpoint is not on that domain, so the publisher may not run this server.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/com.checkmarx%2Fcheckmarx.svg)](https://sourceweft.com/mcp/com.checkmarx%2Fcheckmarx?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Connects an AI coding assistant to Checkmarx One so it can scan projects, inspect findings, and apply AI remediation on demand.

What you can do: A hosted MCP server that links any MCP-capable assistant to the Checkmarx One application security platform. It exposes scanning, findings inspection, project management, and AI-generated remediation as tools the assistant can call in conversation. The repository also ships separate Developer Assist plugins that gate scannable file writes before they land on disk, but those are distinct from the MCP server itself.
When to use it: Use it when you want on-demand security scanning and fix-it workflows inside an MCP client such as Claude, Cursor, Copilot, Windsurf, or Kiro. It suits teams already using Checkmarx One who want generated code checked for vulnerabilities as it is written rather than after the fact.
Requirements: A remote MCP endpoint reached at a Checkmarx One base URL, plus an MCP-capable client. Authentication is documented as API key or OAuth2 setup. The companion Developer Assist plugins additionally require the Checkmarx One CLI (cx) and a supported client.

Before you install

The server can trigger scans and apply AI-generated remediation, which changes code, so review proposed fixes before accepting them. It requires Checkmarx One credentials such as an API key or OAuth2 setup; treat those as secrets. Scan data and code content are sent to the Checkmarx One platform.

Installation

In SourceWeft

Open Checkmarx in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Other MCP clients

Follow the launch instructions in the repository.

README

[Logo]

[Contributors] [Forks] [Stargazers] [Issues] [License]

Checkmarx Agentic AI

Checkmarx application security, built for AI coding agents.

Report Bug · Request Feature

Table of Contents

Overview

AI coding assistants generate code quickly, but that code can carry the same security risks as code written by hand. This repository connects Checkmarx One — Checkmarx's application security platform — to those assistants, so generated code is scanned for vulnerabilities as it's written, not after the fact.

This repository ships two complementary ways to bring Checkmarx One into an AI-assisted workflow. Use them together or separately — they solve different halves of the problem.

Checkmarx Security MCP — a hosted MCP server any MCP-capable assistant can call to scan, inspect findings, and apply AI remediation on demand.
Developer Assist plugins — fail-closed gates that scan scannable file writes before they land on disk, for Claude Code, Cursor, GitHub Copilot CLI, Codex CLI, and Gemini CLI.

Piece	What it does	When to use it
Checkmarx Security MCP	Tools the assistant can call — scan a project, inspect findings, apply AI remediation	You want on-demand scanning and fix-it workflows in any MCP client
Developer Assist plugins	A fail-closed gate — scannable file writes are scanned before they land on disk	You want the check to be automatic and non-optional

The plugins wrap the Checkmarx One CLI (ast-cli) (cx) for install, authentication, and native hook scanning, and they start the same MCP server for remediation.

Checkmarx Security MCP

A hosted MCP server that connects any MCP-capable AI client — Claude, Cursor, Copilot, Windsurf, Kiro — to Checkmarx One. It exposes scanning, findings, project management, and AI-generated remediation as tools your assistant can call in conversation.

Configure it once (see examples/ for per-client config) and ask.

Details → README-MCP.md

Cursor: MCP-only install

plugins/cx-cursor-plugin is a lightweight Cursor marketplace plugin that registers the Checkmarx MCP server only — no hook chain, no file-write gate, just the MCP tools. Use it when you want Checkmarx MCP tools in Cursor without adopting the Developer Assist gate.

Details → plugins/cx-cursor-plugin/README.md

Developer Assist Plugins

Each plugin provides the same fail-closed security gate, wired in as a native hook for its client. Before the agent writes or edits a scannable file, the Checkmarx cx CLI scans the proposed content — real vulnerabilities are blocked rather than silently allowed, as is the case where the scanner itself can't be trusted to run. Shell commands are never gated. Findings are remediated through the bundled Checkmarx MCP server. Marketplace install and guided cx setup follow the same pattern across clients; only the client integration differs.

Plugin	Client	Details
`cx-devassist`	Claude Code	plugins/cx-devassist/README.md
`cursor-devassist`	Cursor	plugins/cursor-devassist/README.md
`copilot-devassist`	GitHub Copilot CLI	plugins/copilot-devassist/README.md
`codex-devassist`	Codex CLI	plugins/codex-devassist/README.md
Root extension	Gemini CLI	docs/gemini-cli-devassist.md

Checkmarx One CLI

The plugins install and drive the Checkmarx One CLI (cx) from Checkmarx/ast-cli. That CLI wraps Checkmarx One APIs for scans, authentication, and the native agent-hook scanners (ASCA, KICS, SCA).

Releases and platform downloads: ast-cli releases.

Documentation: Checkmarx One CLI tool.

Documentation

README-MCP.md — MCP server overview, auth, and client config
docs/usage.md — MCP tool catalog and example workflows
docs/authentication.md — API key and OAuth2 setup
docs/troubleshooting.md — connection, auth, and scan issues
docs/gemini-cli-devassist.md — Gemini CLI extension install, hooks, and skills
CONTRIBUTING.md — how to contribute

Contributing

We appreciate feedback and contributions. Before you get started, please see:

License

Distributed under the Apache 2.0 license. It governs everything in this repository, including the MCP server and all plugins.

Feedback

We'd love to hear your feedback! If you come across a bug or have a feature request, please let us know by submitting an issue in GitHub Issues.

Contact

Checkmarx One Integrations Team

Project Link: https://github.com/Checkmarx/cx-agentic-ai.

Website: Checkmarx.

Source: README.md at commit 3b783ef

Tools

SourceWeft has not read this server's tools yet.

Version history

v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declaredRequired10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts