# checkmarx [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/Checkmarx/cx-agentic-ai  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/checkmarx

## Description
Official Checkmarx MCP Server

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "checkmarx": {
    "url": "https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0"
  }
}
```

## Documentation & README

# Checkmarx Agentic AI
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

> Checkmarx application security, built for AI coding agents. This repository holds two ways to bring
> [Checkmarx One](https://checkmarx.com/product/application-security-platform/) into an AI-assisted
> workflow: an **MCP server** your assistant can call, and a **Claude Code plugin** that scans code as it
> is written.

Use them together or separately — they solve different halves of the problem.

## Checkmarx Security MCP


A hosted [MCP](https://modelcontextprotocol.io) server that connects any MCP-capable AI client — Claude,
Cursor, Copilot, Windsurf, Kiro — to Checkmarx One. It exposes scanning, findings, project management,
and AI-generated remediation as tools your assistant can call in conversation.

**Reach for this when** you want your assistant to scan projects, investigate findings, or fix them on
request — in whichever AI client you already use. Configure it once (see
[examples/](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/examples) for per-client config) and ask.

## How it works (at a glance)

For more details **→ [README-MCP.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/README-MCP.md)**

## cx-devassist plugin

**→ [plugins/cx-devassist/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/cx-devassist/README.md)**

A fail-closed security gate for [Claude Code](https://claude.com/claude-code). Before Claude writes a
file, runs a command, or calls a tool, the Checkmarx `cx` CLI scans the proposed action. Real
vulnerabilities are **blocked rather than silently allowed** — and so is the case where the scanner
itself can't be trusted to run. Findings are remediated through the bundled Checkmarx MCP server.

**Reach for this when** you want the check to be automatic and non-optional rather than something
someone remembers to ask for.

For more details **→ [plugins/cx-devassist/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/cx-devassist/README.md)**

## cx-cursor-plugin

Plugin for [Cursor](https://cursor.com/) that integrates the Checkmarx MCP server directly through the [Cursor's marketplace](https://cursor.com/marketplace) mechanism.

Refer **→ [README-MCP.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/README-MCP.md)** for more details on the MCP server.

For more details **→ [plugins/cx-cursor-plugin/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/cx-cursor-plugin/README.md)**

## cursor-devassist

**→ [plugins/cursor-devassist/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/cursor-devassist/README.md)**

A fail-closed security gate for [Cursor](https://cursor.com/). Before Cursor writes or edits a
scannable file or calls a Checkmarx MCP tool, the Checkmarx `cx` CLI scans the proposed action. Real
vulnerabilities are **blocked rather than silently allowed** — and so is the case where the scanner
itself can't be trusted to run. Findings are remediated through the bundled Checkmarx MCP server.

**Reach for this when** you want the check to be automatic and non-optional rather than something
someone remembers to ask for.

For more details **→ [plugins/cursor-devassist/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/cursor-devassist/README.md)**

## copilot-devassist

**→ [plugins/copilot-devassist/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/copilot-devassist/README.md)**

A fail-closed security gate for [GitHub Copilot CLI](https://github.com/features/copilot/cli). Before
Copilot creates or edits a file, the Checkmarx `cx` CLI scans the proposed content. Real vulnerabilities
are **blocked rather than silently allowed** — and so is the case where the scanner itself can't be
trusted to run. Findings are remediated through the bundled Checkmarx MCP server.

**Reach for this when** you want the check to be automatic and non-optional rather than something
someone remembers to ask for.

For more details **→ [plugins/copilot-devassist/README.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/plugins/copilot-devassist/README.md)**


## Documentation

- [docs/usage.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/docs/usage.md) — the MCP tool catalog and example workflows
- [docs/authentication.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/docs/authentication.md) — API key and OAuth2 setup
- [docs/troubleshooting.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/docs/troubleshooting.md) — connection, auth, and scan issues

## License

Apache 2.0 — see [LICENSE](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/LICENSE) for details. It governs everything in this repository, including the
`cx-devassist` plugin.

## Contributing

See [CONTRIBUTING.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/CONTRIBUTING.md) for guidelines, and [SECURITY.md](https://github.com/Checkmarx/cx-agentic-ai/blob/HEAD/SECURITY.md) to report a
vulnerability.

Website: [Checkmarx](https://checkmarx.com/).


© 2026 Checkmarx Ltd.