Skip to main content

Developer Assist for Visual Studio

Initial Setup and Configuration

Prerequisites

  • Supported for Visual Studio 2022 and Visual Studio 2026 (tested and verified on Community and Insider editions)

  • Officially supported only for .NET Framework version 4.7.2, 4.8 or 4.8.1.

  • You have an API key for your Checkmarx One account. To create an API key, see Generating an API Key.

    Note

    In order to use this integration for running an end-to-end flow of scanning a project and viewing results with the minimum required permissions, the API Key or user account should have the role plugin-scanner. Alternatively, they can have at a minimum the out-of-the-box composite role ast-scanner as well as the IAM role default-roles.

  • In order to use Dev Assist, you need the following additional prerequisites:

    • A Checkmarx One account with a Checkmarx One Assist license

    • The Checkmarx MCP must be activated for your tenant account. This is done in the Checkmarx One web application (UI) on the Settings > Plugins page. This must be done by an account admin.

    • You must have GitHub Copilot Chat (AI Agent) version 1.5.62-243+ installed

    • You must have Node.js v22.22.0 or above installed in the OS specific PATH environment variable.

Installing the Plugin

The Checkmarx One extension for Visual Studio is available on Visual Studio marketplace and can be installed directly from your Visual Studio console.

To install and set up the extension:

  1. In the Visual Studio console header bar, click on Extensions > Manage Extensions.

    vsextensions.png

    The Manage Extensions window opens with the Online tab selected by default.

  2. In the search box, start entering 'Checkmarx One'.

  3. When the Checkmarx One extension is shown, click Install for that extension.

    vsinstall.png

    A notification at the bottom of the window prompts you to restart Visual Studio.

  4. Click Close and then Exit the program.

    The VSIX Installer dialog opens.

    Image_1101.png

  5. Click Modify.

  6. Open Visual Studio and in the header bar, click View > Other Windows > Checkmarx.

    vscheckmarxwindow.png

    A new Checkmarx pane opens.

  7. Click on Open Settings.

    The Options window opens showing the Checkmarx settings.

    vsoptions.png

  8. In the API key field, enter your Checkmarx One API key.

    Notice

    To create an API key, see Generating an API Key

    The roles (permissions) assigned to the API Key are inherited from the user account that generates the key. Therefore, make sure that you are logged in to an account with the appropriate roles.

    The minimum required roles for running an end-to-end flow of scanning a project and viewing results via the CLI or plugins are Checkmarx One plugin-scanner role and IAM default-roles<tenant> role.

    The permissions included in plugin-scanner are shown here. If you would like to create a custom role with more granular permissions, you should refer to this list of permissions in order to determine which permissions you will need to assign.

  9. In the Additional parameters section you can specify any CLI arguments that you would like to apply as global flags (e.g., proxy servers). See documentation here.

  10. Click OK at the bottom of the screen.

Configuring Checkmarx Developer Assist

  1. Go to the Checkmarx settings and navigate to the Checkmarx One Assist tab.

  2. Make sure that the desired Checkmarx One Assist checkboxes are selected.

    If MCP is activated on the tenant level, then these should be selected by default. You can deselect any scanners that you don't want to run.

    Image_1948.png

  3. For the IaC Realtime scanner, select the Containers Management Tool used in your environment. Options are docker or podman.

  4. Click on Install MCP.

    The Checkmarx MCP is added to your mcp.json file.

    Notice

    In some cases the MCP is installed automatically when you authenticate with Checkmarx. However, best practice is to click onEdit in mcp.json so that the MCP file opens and you can ensure that it starts running, as shown in the following step.

  5. If the process doesn't start automatically, you may need to open the file and click Start.

    Notice

    If there is a problem with the automatic installation, check Troubleshooting - Manually Configuring the Checkmarx MCP Server.

  6. Click OK at the bottom of the window.

  7. Open GitHub Copilot Chat by navigating to View > GitHub Copilot Chat.

  8. Open the Tool Picker (wrench/tool icon).

  9. Confirm that a Checkmarx MCP server appears in the list of available tools.

  10. Expand the server and verify that Checkmarx tools are listed and enabled.

    Checkmarx Developer Assist is now ready for use.

Troubleshooting - Manually Configuring the Checkmarx MCP Server

The extension normally creates and configures the mcp.json file automatically. Manual configuration is only required if automatic configuration fails or if you prefer to create the MCP configuration yourself.

  1. If it does not already exist, create an mcp.json file at the following location: ${homeDir}\.mcp.json

  2. Add the "checkmarx" mcp using the following snippet, replacing the placeholders as follows:

    • Checkmarx_one_base_url - The base URL of your Checkmarx One environment.

    • Checkmarx_one_API_key - An API Key for your Checkmarx One account.

      {
  "inputs": [],
  "servers": {
    "Checkmarx": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "<Checkmarx_one_base_url>/api/security-mcp/mcp",
        "--transport",
        "http-first",
        "--header",
        "Authorization:<Checkmarx_one_API_key>",
        "--header",
        "cx-origin:VisualStudio",
        "--verbose"
      ]
    }
  }
}

Using Developer Assist in Visual Studio

Realtime Scanning

Identify vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Our super-fast scanners run in the background whenever you edit a relevant file. Our scanners identify vulnerabilities and unmasked secrets in your code. We also identify vulnerable or malicious container images and open source packages used in your project. Results are marked as Problems which are highlighted in the code and annotated with identifying icons. The issue is also listed in the Checkmarx One Assist Findings window to enable quick navigation and efficient remediation.

Learn more about Dev Assist realtime scanners here

The Checkmarx One Assist Findings Window

Image_1292.png

The Checkmarx One Assist Findings Window provides a centralized view of all detected issues within a project, displaying them in a custom tool window that lists vulnerabilities per file along with the count of issues grouped by severity and file location. It enables users to navigate directly to the exact line in the editor with a single click and supports filtering and sorting capabilities to improve usability and streamline issue review.

To open the Checkmarx One Assist Findings Window, open the Checkmarx extension by selecting View > Other Windows > Checkmarx, and select the Checkmarx One Assist Findings tab.

AI Remediation

How to Remediate Risks Using AI

The following procedure explains how to remediate risks by clicking on the Fix button for a particular risk. Alternatively, you can request remediation via chat with your AI Agent, as described below.

  1. Open a project in Visual Studio.

  2. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    Image_1284.png

  3. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    visualstudio2.png

  4. Click on Fix with Checkmarx One Assist.

    A Copilot session opens in the side panel and all relevant info is sent for analysis.

    Notice

    Depending on your IDE configuration, you may need to click Confirm several times in order to complete the process.

  5. Copilot automatically makes the necessary changes in the code in order to remediate the risk.

    Image_1291.png

    • If you approve the changes, click Keep.

    • If you do not want to implement the suggestion, click Undo.

    • You can also chat with Copilot to improve upon the suggestion.

Remediation via Chat

You can submit a request for CxOne Dev Assist remediation via natural language chat with your AI Agent. Just say that you want to fix a security risk and indicate which risk or risks you want to fix. Your AI will automatically route the request to the Checkmarx MCP and send all relevant data for analysis in order to generate the suggested remediation. The following are some examples of valid requests:

  • "Fix the vulnerability in line 26"

  • "Fix all critical vulnerabilities"

  • "Fix all SQL Injection risks"

  • "Remediate all vulnerable packages"

  • "Correct all critical issues in my JavaFile.java"

Things to Know About Dev Assist Chat

  • No need to mention "Checkmarx" explicitly; once Dev Assist is installed and running all remediation requests are handled via Checkmarx MCP

  • Support for multi-language prompts

  • Effective in single message context. Improved accuracy in context of an existing thread or finding.

  • By default, requests are interpreted in the context of the current open file (e.g., line 26 of the open file). You can specify a different file in your workspace.

Ignoring Risks

In order to help you to focus on actionable risks, Checkmarx Dev Assist enables marking risks as Ignore, so that the risks will no longer be shown in your IDE. This can be applied to a specific instance of a risk or it can be applied to all instances of that risk in your project. You can Revive the risk at any time to resume showing risks for that package.

Notice

For risks identified in open source packages, a risk instance refers to the entire package that the vulnerability is associated with.

To Ignore a Risk

  1. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    Image_1284.png

  2. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    visualstudio2.png

  3. To ignore the risk in this particular instance, click on Ignore this vulnerability.

  4. To ignore all instances of the risk, click on Ignore all of this type.

The ignored risk will now appear in the Ignored Findings tab of the Checkmarx window.

To revive a package:

  1. Navigate to the Ignored Findings tab of the Checkmarx window.

    Image_448.png

  2. For the desired vulnerability click on the Revive button.

    Notice

    This can also be done as a bulk action for all selected items.

In this section: