Skip to main content

Developer Assist for JetBrains

Initial Setup and Configuration

Prerequisites

  • A Checkmarx One account with a Checkmarx One Assist license. The Checkmarx MCP must be activated for your tenant account in the Checkmarx One UI under Settings > Plugins page. This must be done by an account admin.

    Checkmarx One users will need to provide:

    • an API Key (see Generating an API Key), OR

    • login credentials (Base URL, Tenant name, Username and Password)

  • You are running IntelliJ version 2024.3+ and have GitHub Copilot Chat (AI Agent) version 1.5.62-243+ installed

Installing the Plugin

The Checkmarx JetBrains Plugin is available on the JetBrains marketplace, and can be installed directly from your JetBrains IDE console.

To install the plugin from the marketplace:

  1. Open your JetBrains IDE console (e.g., IntelliJ IDEA).

  2. Go to Settings > Plugins and click on the Marketplace tab.

  3. Search for the Checkmarx plugin, then click Install for that plugin.

    JetBrainsInstall.png

  4. Follow the prompts to run the installation.

    The plugin is installed.

Automatic Updates - Release Versions and Pre-Release Versions

Once you have installed the Checkmarx plugin, it is automatically updated to the latest version whenever we create a new release.

Whenever new code is merged in between full releases, we create nightly pre-release versions. You can choose to install a pre-release version. Once you have installed a pre-release version, you will continue to get automatic updates whenever a new pre-release (or release) is created.

Warning

Pre-release versions haven't been tested and approved for distribution. Therefore, there is some degree of risk involved in using pre-release versions.

To start getting pre-release versions:

  1. Select Plugins in the left-hand navigation,and click on the Settings.png icon in the header bar.

  2. Select Manage Plugin Repositories.

    Image_110.png

  3. In the Custom Plugin Repositories dialog click "+" and enter https://plugins.jetbrains.com/plugins/nightly/17672/, then click OK.

  4. Search for the Checkmarx plugin.

    The latest pre-release version is shown.

  5. Click Update and then click OK.

    Notice

    You can revert at any time to only getting release versions by opening the Custom Plugin Repositories dialog and deleting the nightly channel.

Setting up the Plugin

After installing the plugin, in order to use the Checkmarx One Assist tool you need to configure access to your Checkmarx One account, as described below.

Note

If you would like to use a proxy server, you can set up a proxy variable in one of two ways. See below.

  1. In the JetBrains console, click on the Settings.png icon at the bottom left of the screen, then navigate to Tools > Checkmarx One.

    The Checkmarx One Settings window is shown.

    JetBrainsSettings.png

  2. In the Credentials section, connect to Checkmarx One either using an API Key or your login credentials.

    Important

    In order to use this integration for running an end-to-end flow of scanning a project and viewing results with the minimum required permissions, the API Key or user account should have the Checkmarx One plugin-scanner role and the IAM default-roles<tenant> role.

    The permissions included in plugin-scanner are shown here. If you would like to create a custom role with more granular permissions, you should refer to this list of permissions in order to determine which permissions you will need to assign.

    • Login Credentials

      1. Select the OAuth radio button.

      2. Enter the Base URL of your Checkmarx One environment and the name of your tenant account, then click Connect to Checkmarx.

        Notice

        Once you have submitted a base URL and tenant name, it is saved in cache and can be selected for future use (saves up to 10 accounts).

      3. If you are logged in to your account, the system connects automatically. If you are not logged in, your account's login page opens in your browser. Enter your Username and Password and then your One-Time Password (2FA) to log in.

    • API Key (see Generating an API Key)

      1. Select the API key checkbox.

      2. In the API key textbox, enter your Checkmarx One API Key, and then click on Connect to Checkmarx.

  3. A Checkmarx welcome page is displayed immediately after a successful login.

  4. In the Settings tab, you can submit additional CLI params in the Additional parameters box. This can be used to manually submit the base url and tenant name if there is a problem extracting them from the API Key. It can also be used to add global params such as --debug or --proxy. To learn more about CLI global params, see Global Flags.

  5. Click on Connect to Checkmarx, to test that the connection works.

    Notice

    If the connection fails, you can view detailed error logs by entering --debug in the Additional parameters section and retrying the connection.

  6. Click OK at the bottom of the screen.

Configuring Checkmarx Developer Assist

  1. Navigate to JetBrains settings, drill down to tools > Checkmarx One > Checkmarx One Assist. Alternatively: If a project is open, click on the Checkmarx icon in the left-hand navigation bar and click on the settings icon. In the window that opens, click on Go to Checkmarx One Assist toward the bottom of the window.

    The Checkmarx One Assist settings window is displayed.

  2. Make sure that the desired Checkmarx One Assist checkboxes are selected.

    If MCP is activated on the tenant level, then these should be selected by default. You can deselect any scanners that you don't want to run.

  3. For the IaC Realtime scanner, select the Containers Management Tool used in your environment. Options are docker or podman.

    • For Windows: Verify that the Container Management Tool selected is installed on your system.

    • For macOS and Linux: Verify that docker or podman is installed in /usr/local/bin.

      If docker or podman are installed in a different location, you must create a symbolic link using the following procedure:

      For docker:

      1. Check the installation path by running the following command (in terminal, not in InteliJ): which docker.

      2. Create a symbolic link: run the following command: sudo ln -s <PASTE_THE_PATH_HERE> /usr/local/bin/docker, replacing the placeholder with the full link returned in the previous step. For example: If which docker returned /opt/homebrew/bin/docker, run sudo ln -s /opt/homebrew/bin/docker /usr/local/bin/docker.

      3. Pull the required kics images using the following command: docker pull checkmarx/kics:v2.1.29.

        Warning

        The change will not register until you close and restart the IDE.

      For podman:

      1. Check the installation path by running the following command(in terminal, not in IntelliJ): which podman.

      2. Create a symbolic link: run the following command: sudo ln -s <PASTE_THE_PATH_HERE> /usr/local/bin/podman, replacing the placeholder with the full link returned in the previous step. For example: If which podman returned /opt/homebrew/bin/podman, run sudo ln -s /opt/homebrew/bin/podman /usr/local/bin/podman.

      3. Pull the required kics images using the following command: podman pull checkmarx/kics:v2.1.29.

        Warning

        The change will not register until you close and restart the IDE.

  4. Click on Install MCP.

    The Checkmarx MCP is added to your mcp.json file.

    Notice

    In some cases the MCP is installed automatically when you authenticate with Checkmarx. However, best practice is to click on Install MCP so that the MCP file opens and you can ensure that it starts running, as shown in the following step.

  5. If the process doesn't start automatically, you may need to open the file and click Start.

    Image_143.png

    Notice

    If there is a problem with the automatic installation, check Troubleshooting - Configuring the Checkmarx MCP Server.

  6. Click OK at the bottom of the window.

Troubleshooting - Configuring the Checkmarx MCP Server

The extension normally creates and configures the mcp.json file automatically. Manual configuration is only required if automatic configuration fails or if you prefer to create the MCP configuration yourself.

  1. If it does not already exist, create an mcp.json file at the following location: ${homeDir}\AppData\Local\github-copilot\intellij\mcp.json

  2. Add the "checkmarx" mcp using the following snippet, replacing the placeholders as follows:

    • Checkmarx_one_base_url - The base URL of your Checkmarx One environment.

    • Checkmarx_one_API_key - An API Key for your Checkmarx One account.

      {
   "servers":{
      "Checkmarx":{
         "url":"<Checkmarx_one_base_url>/api/security-mcp/mcp",
         "requestInit":{
            "headers":{
               "cx-origin":"Jetbrains",
               "Authorization":"<Checkmarx_one_API_key>"
            }
         }
      }
   }
}

  3. Confirm that the MCP is Running.

    Image_882.png

Setting up a Proxy Variable (Optional)

There are two ways to set up a proxy variable in JetBrains: using additional parameters in JetBrains or using your system’s environment variables.

Setting up a Proxy Variable using your OS System Environment Variables

  • In your operating system (e.g., Windows, iOS, Linux, etc.), set up a system environment variable with the following configuration:

    • In the Name field, enter HTTP_PROXY.

    • In the Value field, enter the value of your proxy address using the following format:http://<proxy_ip>:<port_number> If authentication is required, then the format should be: http://<username>:<password>@<proxy_ip>:<port_number>.

      Notice

      Make sure to include the http:// prefix.

      It is not recommended to pass the username and password in clear text.

Setting up a Proxy using Additional Parameters

  1. In the main navigation, click Customize > All settings.

    The Settings window is shown.

  2. In the Settings window, click Tools > Checkmarx One (or search for Checkmarx One in the search box).

    The Checkmarx JetBrains plugin configuration settings are shown.

  3. In the Additional parameters section, configure your proxy using the following format http://<proxy_ip>:<port_number>. If authentication is required, then the format should be http://<username>:<password>@<proxy_ip>:<port_number>.

    Notice

    Make sure to include the http:// prefix.

    It is not recommended to pass the username and password in clear text.

  4. Click OK at the bottom of the screen.

Using Developer Assist in JetBrains

Identify vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Our super-fast scanners run in the background whenever you edit a relevant file. Our scanners identify vulnerabilities and unmasked secrets in your code. We also identify vulnerable or malicious container images and open source packages used in your project. Results are marked as Problems which are highlighted in the code and annotated with identifying icons. The issue is also listed in the Checkmarx One Assist Findings window to enable quick navigation and efficient remediation.

AI Remediation

How to Remediate Risks Using AI

The following procedure explains how to remediate risks by clicking on the Fix button for a particular risk. Alternatively, you can request remediation via chat with your AI Agent, as decribed below.

  1. Open a project in IntelliJ IDEA.

  2. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    JetBrainsFindings.png

  3. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    JetBrainsFix.png

  4. Click on Fix with Checkmarx One Assist.

    A Copilot session opens in the side panel and all relevant info is sent for analysis.

    Notice

    Depending on your IDE configuration, you may need to click Continue several times in order to complete the process.

  5. Copilot automatically makes the necessary changes in the code in order to remediate the risk.

    JetBrainsAccept.png

    • If you approve the changes, click Accept All.

    • If you do not want to impliment the suggestion, click Discard All.

    • You can also chat with Copilot to improve upon the suggestion.

    A REMEDIATION.TODO.txt file is displayed, explaining the changes that were made and what steps remain to be taken.

Remediation via Chat

You can submit a request for CxOne Dev Assist remediation via natural language chat with your AI Agent. Just say that you want to fix a security risk and indicate which risk or risks you want to fix. Your AI will automatically route the request to the Checkmarx MCP and send all relevant data for analysis in order to generate the suggested remediation. The following are some examples of valid requests:

  • "Fix the vulnerability in line 26"

  • "Fix all critical vulnerabilities"

  • "Fix all SQL Injection risks"

  • "Remediate all vulnerable packages"

  • "Correct all critical issues in my JavaFile.java"

Things to Know About Dev Assist Chat

  • No need to mention "Checkmarx" explicitly; once Dev Assist is installed and running all remediation requests are handled via Checkmarx MCP

  • Support for multi-language prompts

  • Effective in single message context. Improved accuracy in context of an existing thread or finding.

  • By default, requests are interpreted in the context of the current open file (e.g., line 26 of the open file). You can specify a different file in your workspace.

The Checkmarx One Assist Findings Window

JetBrainsFindings.png

The Checkmarx One Assist Findings Window provides a centralized view of all detected issues within a project, displaying them in a custom tool window that lists vulnerabilities per file along with the count of issues grouped by severity and file location. It enables users to navigate directly to the exact line in the editor with a single click and supports filtering and sorting capabilities to improve usability and streamline issue review.

To open the Checkmarx One Assist Findings Window, click on the Checkmarx icon in the left navigation bar and select the Checkmarx One Assit Findings tab.

Ignoring Risks

In order to help you focus on actionable risks, Checkmarx One Assist enables marking risks as Ignore, so that the risks will no longer be shown in your IDE. You can Revive a risk at any time to resume showing that risk. This can be applied to a specific instance of a risk or it can be applied to all instances of that risk in your project.

Notice

For risks identified in open source packages, a risk instance refers to the entire package that the vulnerability is associated with.

To ignore a risk

  1. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    JetBrainsFindings.png

  2. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    JetBrainsFix2.png

  3. To ignore the risk in this particular instance, click on Ignore this vulnerability.

  4. To ignore all instances of the risk, click on Ignore all of this type.

To revive a risk:

JetBrainsRevive.png

The Ignored Findings tab opens.

Notice

This can also be done as a bulk action for all selected items.

  1. Click on the Ignored Findings tab in the Checkmarx window.

  2. For the desired vulnerability, click on the Revive button.

In this section: