Skip to main content

Cursor CLI Plugin

Developer Assist for Cursor CLI intercepts file writes and package installations performed by Cursor CLI, runs security scans on the targeted content, and returns findings directly to the agent — enabling it to automatically remediate issues and retry the operation before the action is allowed to proceed. Remediation occurs automatically upon risk detection, with no need for user action to initiate it. The plugin is installed directly from the marketplace. The Checkmarx CLI is installed automatically as part of the process — the only requirement is authenticating with Checkmarx One. Once in place, the plugin runs automatically on all code generation performed by Cursor CLI.

Realtime Scanners

This plugin currently runs the following scanners:

Prerequisites

  • A Checkmarx One account with a Checkmarx One Assist license. Also, Dev Assist must be activated for your tenant account in the Checkmarx One UI under Global Settings > Plugins page. This must be done by an account admin.

    Users will need to provide:

    • an API Key (see Generating an API Key), OR

    • login credentials (Base URL, Tenant name, Username and Password)

  • The plugin is based on the Checkmarx CLI which it installs automatically. However, it relies on host-provided dependencies that must be installed beforehand. The following table explains these requirements.

Requirement

Why it's needed

Windows

macOS

Linux

POSIX shell ( sh )

Runs the check script. On Windows this is Git Bash.

Git for Windows - mandatory

Warning

If this prerequisite is missing, the installation proceeds without error. But the Checkmarx tools aren't activated.

Tip

The following path must be set as an environment variable for the installation C:\Program Files\Git\bin.

Built in

Built in

Python 3 or above

Runs the readiness logic.

Install from python.org — not the Microsoft Store stub.

xcode-select --install or brew install python3

apt / dnf / apk install python3

curl or wget

Downloads the Cx CLI during install.

Bundled with Git for Windows

Built-in curl

Usually present; minimal images may need it

Connectivity Requirements

The following network connections must be available:

  • GitHub - https://github.com/Checkmarx/ast-cli This is needed specifically during download and version updates.

  • Checkmarx tenant URL - required for authentication, scanning, remediation etc.

  • Identity/sign-in host (IdP/auth URL) - for sign in, when using OAuth

Notice

If your environment requires an HTTP proxy for outbound network access, configure it using the http_proxy or CX_HTTP_PROXY environment variable.

Installation and Setup

  1. Start running the Cursor CLI.

  2. Add the Developer Assist plugin in marketplace, using the following command:

    /plugin marketplace add https://github.com/Checkmarx/cx-agentic-ai

  3. Install the plugin using the following command:

    /cx-install-wiring

    Notice

    During the installation, the plugin verifies that the minimum required version of the Checkmarx One CLI is installed. If it isn't already installed then it installs automatically.

  4. You are prompted to specify the installation scope as User or Project. For Project, you are asked whether to use this repo (show the resolved path) or another path (developer supplies it); validate the directory exists.

  5. Install hooks and rules by running:

    install-hooks.sh

  6. Cursor automatically runs cx-cli-setup skill to initiate authentication. The prompt asks you to choose an Auth method. Options are API Key or Browser sign-in (OAuth).

    • For API Key (recommended), enter a Checkmarx One API Key. To generate an API Key, see Creating an API Key for Checkmarx One Integrations.

    • For OAuth, you will be redirected to browser-based login. You will need to specify your CxOne base url, tenant name, username and password.

      Notice

      If an MDM admin has configured a properties file for your tenant, then you won't be required to enter the base url and tenant name.

  7. Restart the plugin by running:

    /exit

  8. Load the hooks, rules and MCP bridge by running:

    agent

  9. Verify that the Checkmarx MCP is connected by running /mcp and checking the status of the Checkmarx MCP.

    Notice

    The MCP should start automatically by running a local proxy process (cx mcp bridge) that reads the customer's credential from the cx config, figures out the correct tenant-specific URL, and forwards remediation requests to Checkmarx over HTTPS with the credential sent only in the Authorization header. If the URL can't be derived automatically (some dev/on-prem hosts), set it explicitly with CX_MCP_URL or the --mcp-url argument.

Optional Configuration

You can optionally customize the plugin functionality by adjusting the values of these variables. If not configured, sensible defaults are applied.

Variable

Purpose

CX_BINARY

Absolute path to cx when it is not available on PATH. The specified file must be a valid, recent, capable, and authenticated cx executable.

CX_GATE_ALL_FILES=1

Gate every file write, not just types the Checkmarx engines can scan — restores pre-scoping behavior.

CX_GATE_ALL_COMMANDS=1

Disable the read-only-command and cx version/cx utils env diagnostic carve-outs, so every Shell command is evaluated by the gate's own logic (shell commands themselves are still never blocked by this gate.).

CX_LOG_DIR

Overrides the log directory. The default directory is ~/.checkmarx/agent-logs/cursor/.

CX_ALLOW_UNLICENSED=1

Allow writes to proceed (with a logged warning) when cx is authenticated but has no AI-scanning license, instead of denying — accepts that those writes are unscanned.

CX_LOG_DISABLE=1

Disables structured logging entirely.

CX_ASSISTANT

Specifies the assistant label used in logs. Default: cursor

CX_REQUIRE_CHECKSUM=1

Make cx-bootstrap.sh refuse to install an asset it can't checksum-verify.

CX_ALLOW_UNSCANNED=1

Enables an audited emergency bypass that runs the action without scanning and records the action in the audit log.

Triggering Scans

Checkmarx Realtime scanners run automatically on new code generated by Cursor CLI. In addition, you can manually run the scanners by asking Cursor CLI to scan a file or check your dependencies. When you ask to scan a source code file, the ASCA scanner runs. When you ask to scan a manifest file, the OSS-Realtime scanner runs.

In this section: