Checkmarx Security MCP

A production-ready Model Context Protocol (MCP) server that connects AI coding assistants to Checkmarx One — enabling real-time security scanning, vulnerability management, and AI-generated remediation directly inside your IDE or AI agent.

Table of Contents

• Overview

  • Supported scan engines

  • Supported transport protocols

• Features

• Authentication

  • API Key Authentication

  • OAuth2 Authentication

• MCP Client Configuration

  • Prerequisites

  • JSON Configuration

    • Windsurf IDE

    • IntelliJ IDEA - GitHub Copilot

    • Claude Desktop / Claude Code

• Available Tools

  • Scanning

  • Project management

  • Application management

  • Analytics & risk

  • Remediation

Related MCP server: stepsecurity-mcp

Overview

The Checkmarx Security MCP server bridges your AI assistant (Claude, Cursor, Copilot, etc.) with Checkmarx One's enterprise application security platform. It exposes security workflows as natural-language-accessible MCP tools, allowing developers to scan code, investigate findings, and receive context-aware fixes without leaving their development environment.

Supported scan engines:

• SAST — Static Application Security Testing (30+ languages)

• SCA — Software Composition Analysis (open-source dependencies)

• KICS — Infrastructure as Code security (Terraform, CloudFormation, Kubernetes, Dockerfile)

• Secret Detection — Hardcoded credentials, API keys, tokens

Supported transport protocols

Multi-protocol support to facilitate secure and efficient communication between clients and the server:

• stdio: Standard input/output for CLI or embedded agents

• sse (Server-Sent Events): For real-time streaming to web-based clients

• httpstreamableHttp: HTTP-compatible protocol for stream-based messaging

Features

Authentication

The server uses API Key and OAuth2 authentication.

API Key Authentication

1. Clients authenticate to Checkmarx One and get an API key.

2. This API key will be used during MCP client configuration, include the API Key in the Authorization header as mentioned in the MCP Client Configuration section.

OAuth2 Authentication

Checkmarx MCP supports Dynamic Client Registration (DCR) flow allows an AI client (such as Cursor or Claude Desktop) to connect securely.

1. User only needs to configure the MCP client as mentioned in the MCP Client Configuration section.

2. When the client attempts to connect to the MCP server, it will be redirected to Checkmarx One login page for authentication.

3. Once authentication is successful with valid Checkmarx credentials, the MCP client can use the tools provided by the MCP server.

Note: You required valid Checkmarx credentials to get the API Key or connect to the MCP server.

Refer Authentication for detailed authentication instructions and troubleshooting.

MCP Client Configuration

Prerequisites

• A Checkmarx One tenant

• Checkmarx API Host

• API Key (with required access if using API key authentication)

JSON Configuration

Below are examples to add the server to your MCP client configuration. See the examples/ folder for ready-to-use client config files.

Windsurf IDE

API Key Authentication:

{
  "mcpServers": {
    "Checkmarx": {
      "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}",
      "headers": {
        "cx-origin": "Windsurf",
        "Authorization": "API_KEY"
      }
    }
  }
}

OAuth2 Authentication

{
  "mcpServers": {
    "Checkmarx": {
      "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}"
    }
  }
}

Claude Desktop / Claude Code

API Key Authentication:

{
  "mcpServers": {
    "Checkmarx": {
      "type": "http",
      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
      "headers": {
        "Authorization": "<API_KEY>"
      }
    }
  }
}

Available Tools

Refer usage for detail information.

Scanning

Project management

Application management

Analytics & risk

Remediation

License

Apache 2.0 — see LICENSE for details.

Contributing

See CONTRIBUTING.md for development setup, module architecture, and contribution guidelines.

Website: Checkmarx.

© 2026 Checkmarx Ltd. All Rights Reserved.