Skip to main content

Developer Assist for Eclipse

Initial Setup and Configuration

Prerequisites

  • An eclipse installation, version 2025-06 and above with GitHub Copilot.

    Notice

    Supported platforms: Windows, Mac, Linux/GTK

  • A Checkmarx One account with a Checkmarx One Assist license. Also, Dev Assist must be activated for your tenant account in the Checkmarx One UI under Global Settings > Plugins page. This must be done by an account admin.

    Users will need to provide a Checkmarx One API Key (see Generating an API Key)

Installing the Plugin

The plugin can be installed from the Eclipse marketplace. There is an alternative method for installing the plugin from a zip archive.

To install the plugin from the marketplace:

  1. In the Eclipse console, click on Help > Eclipse Marketplace…

  2. In the Find box, enter “checkmarx one” and click Go.

    Installing_Eclipse_1.png

  3. Click Install for the Checkmarx One Plugin.

    Installing_Eclipse_2.png

  4. In the Review Licenses window, after reviewing the license information, select the I accept... radio button and click Finish.

    Installing_Eclipse_3.png

  5. In the Trust Authorities and Trust Artifacts windows, select the trusted content and click Trust Selected.

    Installing_Eclipse_4.png
    Installing_Eclipse_5.png

  6. If a security warning is shown, click Install anyway to complete the plugin installation.

    When the installation is finished, you will be prompted to restart the Eclipse IDE to apply the plugin update.

Installing the Plugin from a Zip Archive

To install the plugin manually from a zip archive:

  1. Download the “com.checkmarx…” zip file here.

  2. In the Eclipse console, click on Help > Install New Software > Add > Archive.

    6140723401.png

  3. In the window that opens, navigate to the downloaded zip file and click Open.

  4. In the Add Repository window, optionally enter a Name for the plugin (e.g., Checkmarx One Plugin) then click Add.

  5. In the Available Software window, select the Checkmarx One Eclipse Plugin checkbox, and click Next.

    6141149410.png

  6. Review the information in the Install Details window, and click Next.

  7. In the Review Licenses window, after reviewing the license information, select the I accept… radio button and click Finish.

    6140657821.png

  8. If a security warning is shown, click Install anyway to complete the plugin installation.

    When the installation is finished, you will be prompted to restart the Eclipse IDE to apply the plugin update.

Setting up the Plugin

After installing the plugin, in order to use the Checkmarx One Assist tool, you need to configure access to the Checkmarx One server, as described below.

To set up the plugin:

  1. In the top menu, click Window > Preferences. (For Mac OS, click Eclipse > Preferences.)

    Installing_Eclipse_6.png

    The Preferences configuration window is shown.

  2. In the Preferences window, click Checkmarx One (or search for Checkmarx One in the search box).

    The Checkmarx One Eclipse plugin configuration settings are shown.

    eclipse.png

  3. In the API Key field, enter your Checkmarx One API key.

    Notice

    To create an API key, see Generating an API Key

    The roles (permissions) assigned to the API Key are inherited from the user account that generates the key. Therefore, make sure that you are logged in to an account with the appropriate roles.

    The minimum required roles for running an end-to-end flow of scanning a project and viewing results via the CLI or plugins are Checkmarx One plugin-scanner role and IAM default-roles<tenant> role.

    The permissions included in plugin-scanner are shown here. If you would like to create a custom role with more granular permissions, you should refer to this list of permissions in order to determine which permissions you will need to assign.

  4. In the Additional Params field, you can submit additional CLI params. This can be used to manually submit the base url and tenant name if there is a problem extracting them from the API Key. It can also be used to add global params such as --debug or --proxy. To learn more about CLI global params, see Global Flags.

  5. Click on Connect to Checkmarx.

    Notice

    If the connection fails, you can view detailed error logs by entering --debug in the Additional Options section and retrying the connection.

    The Welcome to Checkmarx window opens.

Configuring Checkmarx Developer Assist

For accounts with Checkmarx Dev Assist, the welcome screen shows the "Code smarter with Checkmarx One Assist" section.

  1. Select Code Smarter with Checkmarx One Assist checkbox, and click Close.

    Image_1441.png

    The Checkmarx MCP is installed and starts running automatically.

  2. Go to Preferences > GitHub Copilot > Model Context Protocol, and verify that the Checkmarx tools are shown and the checkboxes are selected.

    Image_1454.png

  3. To optionally adjust the Developer Assist settings, in the Preferences window, go to Checkmarx > Checkmarx One Assist. You can adjust the settings as follows:

    1. Make sure that the desired Checkmarx One Assist checkboxes are selected. You can deselect any realtime scanners that you don't want to run.

      Image_1440.png

    2. For the IaC Realtime scanner, select the Containers Management Tool used in your environment. Options are docker or podman.

Troubleshooting - Configuring the Checkmarx MCP Server

The extension normally installs the Checkmarx MCP automatically. If you encounter a problem, you can install it manually.

  1. Go to Preferences > GitHub Copilot > Model Context Protocol.

  2. Paste the following snippet into the Server Configurations window, replacing the placeholders as follows:

    • Checkmarx_one_base_url - The base URL of your Checkmarx One environment.

    • Checkmarx_one_API_key - An API Key for your Checkmarx One account.

      {
   "servers":{
      "Checkmarx":{
         "url":"<Checkmarx_one_base_url>/api/security-mcp/mcp",
         "requestInit":{
            "headers":{
               "cx-origin":"eclipse-plugin",
               "Authorization":"<Checkmarx_one_API_key>"
            }
         }
      }
   }
}

  3. Click Apply and Close.

Using Developer Assist in Eclipse

Identify vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Our super-fast scanners run in the background whenever you edit a relevant file. Our scanners identify vulnerabilities and unmasked secrets in your code. We also identify vulnerable or malicious container images and open source packages used in your project. Results are marked as Problems which are highlighted in the code and annotated with identifying icons. The issue is also listed in the Checkmarx One Assist Findings window to enable quick navigation and efficient remediation.

AI Remediation

How to Remediate Risks Using AI

The following procedure explains how to remediate risks by clicking on the Fix button for a particular risk. You can also initiate remediation from the Checkmarx One Assist Findings Window, or request remediation via chat with your AI Agent, as described below.

  1. Open a project in Eclipse.

  2. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    Image_1445.png

  3. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    Image_1457.png

  4. Click on Fix with Developer Assist.

    A Copilot session opens in the side panel and all relevant info is sent for analysis.

    Notice

    Depending on your IDE configuration, you may need to click Continue several times in order to complete the process.

  5. Copilot automatically makes the necessary changes in the code in order to remediate the risk.

    • If you approve the changes, click Accept All.

    • If you do not want to implement the suggestion, click Discard All.

    • You can also chat with Copilot to improve upon the suggestion.

    A REMEDIATION.TODO.txt file is displayed, explaining the changes that were made and what steps remain to be taken.

Remediation via Chat

You can submit a request for CxOne Dev Assist remediation via natural language chat with your AI Agent. Just say that you want to fix a security risk and indicate which risk or risks you want to fix. Your AI will automatically route the request to the Checkmarx MCP and send all relevant data for analysis in order to generate the suggested remediation. The following are some examples of valid requests:

  • "Fix the vulnerability in line 26"

  • "Fix all critical vulnerabilities"

  • "Fix all SQL Injection risks"

  • "Remediate all vulnerable packages"

  • "Correct all critical issues in my JavaFile.java"

Things to Know About Dev Assist Chat

  • No need to mention "Checkmarx" explicitly; once Dev Assist is installed and running all remediation requests are handled via Checkmarx MCP

  • Support for multi-language prompts

  • Effective in single message context. Improved accuracy in context of an existing thread or finding.

  • By default, requests are interpreted in the context of the current open file (e.g., line 26 of the open file). You can specify a different file in your workspace.

The Checkmarx One Assist Findings Window

Image_1458.png

The Checkmarx One Assist Findings Window provides a centralized view of all detected issues within a project, displaying them in a custom tool window that lists vulnerabilities per file along with the count of issues grouped by severity and file location. It enables users to navigate directly to the exact line in the editor with a single click and supports filtering and sorting capabilities to improve usability and streamline issue review.

To open the Checkmarx One Assist Findings Window, go to Window > Show View > Other > Checkmarx > Checkmarx One Assist Findings.

You can perform actions on a finding either from the finding in the code, as described in the procedures in this topic, or directly from the Checkmarx One Assist Findings Window. To perform an action from the Findings window, right-click a finding and select one of the following options:

eclipsefindingswindow.png

  • Fix with Checkmarx One Assist — Remediate the finding using Developer Assist.

  • View details — View the finding details.

  • Ignore this vulnerability — Ignore the finding.

Ignoring Risks

In order to help you focus on actionable risks, Checkmarx One Assist enables marking risks as Ignore, so that the risks will no longer be shown in your IDE. You can Revive a risk at any time to resume showing that risk. This can be applied to a specific instance of a risk or it can be applied to all instances of that risk in your project.

Notice

For risks identified in open source packages, a risk instance refers to the entire package that the vulnerability is associated with.

To ignore a risk

The following procedure explains how to ignore a risk directly from the finding in your code. You can also ignore a risk from the Checkmarx One Assist Findings Window.

  1. When Checkmarx realtime scanners identify a risk, it is flagged as a Problem, which is marked in the code with a squiggly underline and annotated in the margin with an icon that indicates the type of risk.

    Image_1445.png

  2. Hover over the vulnerable line of code.

    The Checkmarx dialog opens.

    Image_1457b.png

  3. To ignore the risk in this particular instance, click on Ignore this vulnerability.

  4. To ignore all instances of the risk, click on Ignore all of this type.

To revive a risk:

Notice

This can also be done as a bulk action for all selected items.

  1. Open the ignored findings tab by opening Window > Show View > Other > Checkmarx > Checkmarx Ignored Findings.

    The Ignored Findings tab opens.

    Image_1459.png

  2. Select the desired vulnerability, and click on the Revive button.

    Image_1460b.png
In this section: