GitHub Copilot CLI

Before deploying cx-devassist, ensure developer machines meet the plugin’s host requirements (see README.md):

Windows: Verify that sh is available by running sh --version. If Git for Windows is installed but sh is not recognized, ensure that the Git bin directory is included in PATH.

GitHub Copilot managed settings can be delivered through three methods. All three use the same JSON keys and values — only the delivery mechanism differs, and none is required over the others.

An organization is not limited to a single method. When more than one is present, Copilot resolves settings per key, using the following precedence:

For example, an organization can use native MDM to enforce security-related settings while server-managed settings supply other Copilot configuration. The methods therefore do not need to contain the same set of keys.

Deployment steps for each method are covered in Step 2 — Deploy the Settings.

GitHub Copilot managed settings tell Copilot which marketplace and plugin to make available on managed developer machines.

Configure the settings to register the official Checkmarx marketplace and enable cx-devassist:

{
  "enabledPlugins": {
    "cx-devassist@cx-devassist-marketplace": true
  },
  "extraKnownMarketplaces": {
    "cx-devassist-marketplace": {
      "source": {
        "source": "github",
        "repo": "Checkmarx/cx-agentic-ai",
        "ref": "master",
        "path": ".github/plugin/marketplace.json"
      }
    }
  }
}

This configuration:

With this configuration, the plugin is delivered directly from the official Checkmarx repository. Developers provide their Checkmarx One URL and tenant during initial authentication.

Deploy the managed settings using the method (or methods) you chose in Deployment Methods.

Note: This guide describes the settings that must be deployed. The exact procedure for creating and assigning a native MDM policy depends on the MDM product used by your organization.

Verify the deployment on a test machine before rolling it out broadly.

When using Browser sign-in (OAuth), the Checkmarx One URL and tenant are remembered after initial configuration and do not need to be entered for subsequent operations.

Native MDM and server-managed settings refresh hourly, so policy changes can take effect without a full redeployment of the plugin. File-based settings apply after restarting Copilot CLI or the applicable IDE session.

Audit logs, if enabled, are written to:

~/.checkmarx/agent-logs/copilot-cli/checkmarx-devassist.jsonl

For a private repository, use an access mechanism appropriate for your organization, such as organization-wide repository access, a GitHub App or deploy key available to managed devices, or an internal Git hosting solution.

In the internal repository, edit:

plugins/copilot-devassist/config/cx-onboarding.properties

For example:

cx_base_auth_uri=https://eu.ast.checkmarx.net
cx_tenant=your-org-tenant

Use the Checkmarx One base authentication URL for your region or your on-premises deployment.

You can find the tenant in Checkmarx One under Settings → Identity and Access Management → General Settings (Display Name), or in the Checkmarx One welcome email.

Update the marketplace source in the managed settings to reference the internal repository and the branch, tag, or SHA used for the deployment:

{
  "enabledPlugins": {
    "cx-devassist@cx-devassist-marketplace": true
  },
  "extraKnownMarketplaces": {
    "cx-devassist-marketplace": {
      "source": {
        "source": "github",
        "repo": "YourOrg/cx-agentic-ai",
        "ref": "mdm-v1",
        "path": ".github/plugin/marketplace.json"
      }
    }
  }
}

The marketplace name can remain cx-devassist-marketplace when using a fork. If you rename the marketplace in marketplace.json, update both the marketplace key and the enabledPlugins entry to match.

Deploy the updated managed settings through the same method described in Step 2 — Deploy the Settings.

On a test machine:

Depending on the authentication flow, Copilot may instruct the developer to run the generated cx auth login command manually. The important verification is that the command contains the configured --base-auth-uri and --tenant values without requiring the developer to supply them.

When Checkmarx publishes an updated version:

Do not edit cx-onboarding.properties directly in a developer’s installed plugin directory. Installed plugin files can be overwritten during an update.

Managed enabledPlugins entries cannot be disabled through a developer’s local settings. Change the managed policy to change the organization-wide plugin configuration.

Use strictKnownMarketplaces if your organization wants to restrict which marketplaces users can add.

For example:

{
  "strictKnownMarketplaces": [
    {
      "source": "github",
      "repo": "Checkmarx/cx-agentic-ai",
      "ref": "master",
      "path": ".github/plugin/marketplace.json"
    }
  ],
  "extraKnownMarketplaces": {
    "cx-devassist-marketplace": {
      "source": {
        "source": "github",
        "repo": "Checkmarx/cx-agentic-ai",
        "ref": "master",
        "path": ".github/plugin/marketplace.json"
      }
    }
  },
  "enabledPlugins": {
    "cx-devassist@cx-devassist-marketplace": true
  }
}

An empty strictKnownMarketplaces array ([]) prevents users from adding marketplaces.

If you use an internal fork, the source in strictKnownMarketplaces must match the repository, ref, and path used by the managed marketplace configuration.

GitHub Copilot also supports MCP server policies such as allowedMcpServers and deniedMcpServers.

Because cx-devassist uses the Checkmarx MCP server through cx mcp bridge, ensure that any MCP allowlist used by your organization permits the Checkmarx MCP server.

If your organization does not need MCP restrictions, these settings are not required for the Checkmarx deployment.

GitHub Copilot managed settings provide additional controls such as:

Use these settings according to your organization’s Copilot security policy. They are not Checkmarx-specific requirements.

For the complete set of available controls and their syntax, see the Enterprise managed settings reference.