Skip to main content

Installation and Initial Setup

Initial Setup and Configuration

Prerequisites

  • You have a an API Key for authenticating with Developer Assist

Installating and Configuring the Extension

  1. In the Windsurf IDE main navigation, click on the Extensions icon.

  2. Search for the Checkmarx extension, then click Install for that extension.

    windsurf.png

    The Checkmarx extension is installed, and the Checkmarx icon appears on the left-side navigation panel.

    windsurficon.png

  3. Click on the Checkmarx extension icon.

    The Checkmarx One Authentication sidebar opens:

    windsurfsidebar.png

  4. In the Checkmarx One Authentication sidebar, select the API Key login button.

    The API Key Log in window opens.

    ApiKeyLogin.png

  5. Enter your Checkmarx One API Key and click Log in.

    The Checkmarx One Authentication sidebar will now show that you are logged in.

    windsurflogin.png

  6. A Checkmarx Developer Assist welcome page is displayed immediately after a successful login. Scroll down and click on Mark Done.

  7. To verify that your MCP server is running:

    Image_899.png

    1. Go to Settings > Windsurf Settings.

    2. Under Cascade, click Open MCP Marketplace, and make sure that the Checkmarx Developer Assist MCP is installed and enabled.

  8. You can optionally adjust the Checkmarx Developer Assist Settings as follows:

    1. Add Additional Params to set up custom configuraitions, such as proxy servers or to run in debug mode.

    2. Enable/disable specific realtime scanners. By default, all scanners are enabled.

    3. For IaC realtime scanner you can change the container platform used, Docker (default) or Podman.

    4. MCP Authentication – Select the authentication method used by the Checkmarx MCP server. For SAST On-Prem accounts, only Token Based authentication is supported.

      Notice

      After changing the authentication method, click Install MCP to update the mcp.json configuration.

      • OAuth (default) when the MCP server starts, a browser-based login session is initiated to authenticate with your Checkmarx One account.

        Warning

        OAuth is not supported for SAST On-Prem Accounts

      • Token Based uses the API key associated with your current Checkmarx One login and avoids browser authentication when starting the MCP server.

        Warning

        When this method is used, the API key is stored in the mcp.json file.

In this section: