Skip to main content

Developer Assist for VS Code

Initial Setup and Configuration

Prerequisites

  • A Checkmarx One account with a Checkmarx One Assist license. The Checkmarx MCP must be activated for your tenant account in the Checkmarx One UI under Settings > Plugins page. This must be done by an account admin.

    Checkmarx One users will need to provide:

    • an API Key (see Generating an API Key), OR

    • login credentials (Base URL, Tenant name, Username and Password)

  • You are running VS Code version 1.100.0 or above (supports both settings.json (v1.100–1.101) and mcp.json ( v1.102+) and have GitHub Copilot or Claude Code installed

Installing the Extension

Warning

The Checkmarx VS Code extension includes the Checkmarx One Assist feature as part of the Checkmarx One platform experience and should be used by Checkmarx One customers with a Checkmarx One Assist license. The Checkmarx and Checkmarx Developer Assist VS Code extensions are mutually exclusive. To use the Checkmarx extension, ensure that the Checkmarx Developer Assist extension is uninstalled before installation. If you are not a Checkmarx One customer and are trying to install the Checkmarx Developer Assist VS Code extension, see Initial Setup and Configuration.

The Visual Studio Code Extension is available on the Visual Studio Code marketplace. You can initiate the installation directly from the Visual Studio Code console.

To install the extension:

  1. Open Visual Studio Code.

  2. In the main menu, click on the Extensions icon.

  3. Search for the Checkmarx extension, then click Install for that extension.

    Image_101.png

    Notice

    Auto Update is enabled by default, so the latest version is installed automatically when available. To prevent automatic updates, clear the Auto Update checkbox. When auto update is disabled, the currently installed version remains unchanged until updates are re-enabled.

    The Checkmarx extension is installed and the Checkmarx icon appears in the left-side navigation panel.

    vscodeicon.png

Setting up the Extension

After installing the plugin, in order to use the Checkmarx One Assist tool you need to configure access to your Checkmarx One account, as described below.

Notice

This procedure provides a streamlined setup for users who primarily want to use Checkmarx One Assist. The Checkmarx extension includes additional tools and capabilities that may require further configuration. If you intend to use these additional features, see Installing and Setting up the Checkmarx VS Code Extension

  1. In the VS Code console, click on the Checkmarx extension icon.

    The Checkmarx One Authentication sidebar opens:

    CheckmarxSidePanel.png

  2. In the Checkmarx One Authentication sidebar, connect to Checkmarx One either using an API Key or login credentials.

    Important

    In order to use this integration for running an end-to-end flow of scanning a project and viewing results with the minimum required permissions, the API Key or user account should have the Checkmarx One plugin-scanner role and the IAM default-roles<tenant> role.

    The permissions included in plugin-scanner are shown here. If you would like to create a custom role with more granular permissions, you should refer to this list of permissions in order to determine which permissions you will need to assign.

    • Login Credentials

      1. Select the OAuth login button.

        The OAuth Log in window opens.

        OauthLogin.png

      2. Enter the Base URL of your Checkmarx One environment and the name of your tenant account, then click Log in.

        Notice

        Once you have submitted a base URL and tenant name, it is saved in cache and can be selected for future use (saves up to 10 accounts).

        A confirmation dialog asks for permission to open an external website.

        confirmationdialog.png

      3. Click on Open to proceed.

        Notice

        If you would like to prevent this dialog from opening in the future, click on Configure Trusted Domains and then in the Command Pallete click on Trust....

      4. If you are logged in to your account, the system connects automatically. If you are not logged in, your account's login page opens in your browser. Enter your Username and Password and then your One-Time Password (2FA) to log in.

    • API Key (see Generating an API Key)

      1. Select the API Key login button.

        The API Key Log in window opens.

        ApiKeyLogin.png

      2. Enter your Checkmarx One API Key and click Log in.

  3. The Checkmarx One Authentication sidebar will now show that you are logged in.

    Image_159.png

  4. After you sign in, the Welcome to Checkmarx window opens.

  5. In the Checkmarx One Results sidebar, click on the more options icon in the top right and select Settings.

    checkmarxoneresultssettings.png

  6. In the Additional Params field, you can submit additional CLI params. This can be used to manually submit the base url and tenant name if there is a problem extracting them from the API Key. It can also be used to add global params such as --debug or --proxy. To learn more about CLI global params, see Global Flags.

    additionalparams.png

Configuring Checkmarx Developer Assist

  1. Start the Checkmars MCP server using the following procedure:

    1. In the main menu, click on the Extensions icon.

    2. Expand the MCP SERVERS - INSTALLED tab.

      vscode1.png

    3. In the Checkmarx item, click on the settings icon and select Start Server.

      Notice

      In Vs Code versions prior to v1.116, a dialog may open saying that Dynamic Client Registration isn't supported. In this case, click on the Copy URIs & Proceed button, insert the following client id: cx-mcp-client, and press ENTER.

    4. If prompted, allow VS Code to open the Checkmarx web application and complete the authentication process.

  2. To optionally adjust the Developer Assist settings, go to the Checkmarx settings and select Checkmarx One Assist settings. You can adjust the settings as follows.

    1. Make sure that the desired Checkmarx One Assist checkboxes are selected.

      If MCP is activated on the tenant level, then these should be selected by default. You can deselect any scanners that you don't want to run.

      Image_1948.png

    2. For the IaC Realtime scanner, select the Containers Management Tool used in your environment. Options are docker or podman.

    3. Select the AI Assistant to use for remediation. Options are Copilot (default) or Claude.

      Notice

      The Prefer Native AI Assistant setting is not applicable for VS Code.

    4. MCP Authentication – Select the authentication method used by the Checkmarx MCP server.

      Notice

      After changing the authentication method, click Install MCP to update the mcp.json configuration.

      • OAuth (default) when the MCP server starts, a browser-based login session is initiated to authenticate with your Checkmarx One account.

      • Token Based uses the API key associated with your current Checkmarx One login and avoids browser authentication when starting the MCP server.

        Warning

        When this method is used, the API key is stored in the mcp.json file.

Troubleshooting - Manually Configuring the Checkmarx MCP Server

The extension normally creates and configures the mcp.json file automatically. Manual configuration is only required if automatic configuration fails or if you prefer to create the MCP configuration yourself.

  1. If it does not already exist, create an mcp.json file at the following location: ${homeDir}\AppData\Roaming\Code\User\mcp.json

  2. Configure the mcp.json file for the authentication method that you want to use:

    • OAuth (default) - Authenticates through your Checkmarx One account when the MCP server starts.

      {  
  "servers": {
    "Checkmarx": {
      "type": "http",
      "url": "<Checkmarx_one_base_url>/api/security-mcp/mcp/<tenant-name>",
      "oauth": {
        "clientId": "cx-mcp-client"
      }
    }
  }
}

    • Token Based - Authenticates using a Checkmarx One API key stored in the mcp.json file. Browser authentication is not required when starting the MCP server.

      {
   "servers":{
      "checkmarx":{
         "url":"<Checkmarx_one_base_url>/api/security-mcp/mcp",
         "headers":{
            "cx-origin":"VSCode",
            "Authorization":"<Checkmarx_one_API_key>"
         }
      }
   }
}

  3. Save the file.

  4. For the OAuth method, you may need to manually start the MCP server.

    1. In the main menu, click on the Extensions icon.

    2. Expand the MCP SERVERS - INSTALLED tab.

      vscode1.png

    3. In the Checkmarx item, click on the settings icon and select Start Server.

      Notice

      In Vs Code versions prior to v1.116, a dialog may open saying that Dynamic Client Registration isn't supported. In this case, click on the Copy URIs & Proceed button, insert the following client id: cx-mcp-client, and press ENTER.

    4. When prompted, allow VS Code to open the Checkmarx web application and complete the authentication process.

Using Developer Assist in VS Code

Realtime Scanning

Identify vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Our super-fast scanners run in the background whenever you edit a relevant file. Our scanners identify vulnerabilities and unmasked secrets in your code. We also identify vulnerable or malicious container images and open source packages used in your project. Results are marked as Problems which are highlighted in the code and annotated with identifying icons.

Learn more about Dev Assist realtime scanners here

AI Remediation

How to Remediate Risks Using AI

The following procedure explains how to remediate risks by clicking on the Fix button for a particular risk. Alternatively, you can request remediation via chat with your AI Agent, as decribed below.

  1. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    Image_1949.png

  2. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    image-20250625-065452.png

  3. Click on Fix with CxOne Assist.

    A Copilot session opens in the side panel and all relevant info is sent for analysis.

    Notice

    Depending on your IDE configuration, you may need to click Continue several times in order to complete the process.

  4. Copilot automatically makes the necessary changes in the code in order to remediate the risk.

    • If you approve the change, click Accept.

      The change is made and the code is rescanned to verify that the risk is no longer present.

    • If you want to improve on the suggestion, click Undo. You can then chat with Copilot to determine the best way of remediating the code.

Remediation via Chat

You can submit a request for CxOne Dev Assist remediation via natural language chat with your AI Agent. Just say that you want to fix a security risk and indicate which risk or risks you want to fix. Your AI will automatically route the request to the Checkmarx MCP and send all relevant data for analysis in order to generate the suggested remediation. The following are some examples of valid requests:

  • "Fix the vulnerability in line 26"

  • "Fix all critical vulnerabilities"

  • "Fix all SQL Injection risks"

  • "Remediate all vulnerable packages"

  • "Correct all critical issues in my JavaFile.java"

Things to Know About Dev Assist Chat

  • No need to mention "Checkmarx" explicitly; once Dev Assist is installed and running all remediation requests are handled via Checkmarx MCP

  • Support for multi-language prompts

  • Effective in single message context. Improved accuracy in context of an existing thread or finding.

  • By default, requests are interpreted in the context of the current open file (e.g., line 26 of the open file). You can specify a different file in your workspace.

Ignoring Risks

In order to help you to focus on actionable risks, Checkmarx Dev Assist enables marking risks as Ignore, so that the risks will no longer be shown in your IDE. You can Revive a risk at any time to resume showing that risk. This can be applied to a specific instance of a risk or it can be applied to all instances of that risk in your project. You can revive the risk at any time to resume showing risks for that package.

Notice

For risks identified in open source packages, a risk instance refers to the entire package that the vulnerability is associated with.

To Ignore a risk

  1. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    Image_1949.png

  2. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    Image_147.png

  3. To ignore the risk in this particular instance, click on Ignore this vulnerability.

  4. To ignore all instances of the risk, click on Ignore all of this type.

To revive a package:

  1. Click on the Ignore icon in the bottom bar.

    Image_056.png

  2. The Ignored Vulnerabilities tab opens.

    Image_050.png

  3. For the desired vulnerability click on the Revive button.

    Notice

    This can also be done as a bulk action for all selected items.

In this section: