Integrates with Checkmarx One to enable real-time security scanning, vulnerability management, and AI-generated remediation across SAST, SCA, KICS, and secret detection engines.
Checkmarx application security, built for AI coding agents. This repository holds two ways to bring Checkmarx One into an AI-assisted workflow: an MCP server your assistant can call, and fail-closed plugins (Claude Code, Cursor, Copilot CLI, Gemini CLI) that scan code as it is written.
Use them together or separately — they solve different halves of the problem.
A hosted MCP server that connects any MCP-capable AI client — Claude, Cursor, Copilot, Gemini CLI, Windsurf, Kiro — to Checkmarx One. It exposes scanning, findings, project management, and AI-generated remediation as tools your assistant can call in conversation.
Reach for this when you want your assistant to scan projects, investigate findings, or fix them on request — in whichever AI client you already use. Configure it once (see examples/ for per-client config) and ask.
Related MCP server: StackHawk MCP Server
For more details → README-MCP.md
→ plugins/cx-devassist/README.md
A fail-closed security gate for Claude Code. Before Claude writes a
file, runs a command, or calls a tool, the Checkmarx cx CLI scans the proposed action. Real
vulnerabilities are blocked rather than silently allowed — and so is the case where the scanner
itself can't be trusted to run. Findings are remediated through the bundled Checkmarx MCP server.
Reach for this when you want the check to be automatic and non-optional rather than something someone remembers to ask for.
For more details → plugins/cx-devassist/README.md
Plugin for Cursor that integrates the Checkmarx MCP server directly through the Cursor's marketplace mechanism.
Refer → README-MCP.md for more details on the MCP server.
For more details → plugins/cx-cursor-plugin/README.md
→ plugins/cursor-devassist/README.md
A fail-closed security gate for Cursor. Before Cursor writes or edits a
scannable file or calls a Checkmarx MCP tool, the Checkmarx cx CLI scans the proposed action. Real
vulnerabilities are blocked rather than silently allowed — and so is the case where the scanner
itself can't be trusted to run. Findings are remediated through the bundled Checkmarx MCP server.
Reach for this when you want the check to be automatic and non-optional rather than something someone remembers to ask for.
For more details → plugins/cursor-devassist/README.md
→ plugins/copilot-devassist/README.md
A fail-closed security gate for GitHub Copilot CLI. Before
Copilot creates or edits a file, the Checkmarx cx CLI scans the proposed content. Real vulnerabilities
are blocked rather than silently allowed — and so is the case where the scanner itself can't be
trusted to run. Findings are remediated through the bundled Checkmarx MCP server.
Reach for this when you want the check to be automatic and non-optional rather than something someone remembers to ask for.
For more details → plugins/copilot-devassist/README.md
→ plugins/codex-devassist/README.md
A fail-closed security gate for OpenAI's Codex CLI. Before
Codex runs a shell command, applies a patch, or calls a Checkmarx MCP tool, the Checkmarx cx CLI
scans the proposed action. Real vulnerabilities are blocked rather than silently allowed — and so
is the case where the scanner itself can't be trusted to run. Findings are remediated through the
bundled Checkmarx MCP server.
→ docs/gemini-cli-devassist.md
A fail-closed security gate for Gemini CLI. Before
Gemini creates or edits a file, the Checkmarx cx CLI scans the proposed content. Real vulnerabilities
are blocked rather than silently allowed — and so is the case where the scanner itself can't be
trusted to run. Findings are remediated through the bundled Checkmarx MCP server.
Reach for this when you want the check to be automatic and non-optional rather than something someone remembers to ask for.
For more details → plugins/codex-devassist/README.md For more details → docs/gemini-cli-devassist.md
This extension lives at the repository root (gemini-extension.json, GEMINI.md, hooks/,
scripts/, config/, skills/), since Gemini CLI installs extensions from the root of a repo:
gemini extensions install "C:\path\to\cx-agentic-ai"docs/usage.md — the MCP tool catalog and example workflows
docs/authentication.md — API key and OAuth2 setup
docs/troubleshooting.md — connection, auth, and scan issues
docs/gemini-cli-devassist.md — Gemini CLI extension install, hooks, and skills
Apache 2.0 — see LICENSE for details. It governs everything in this repository, including the Claude Code, Cursor, Copilot CLI, and Gemini CLI plugins.
See CONTRIBUTING.md for guidelines, and SECURITY.md to report a vulnerability.
Website: Checkmarx.
© 2026 Checkmarx Ltd.
This server cannot be deployed
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
