Claude Code CLI

Claude Code managed settings tell Claude Code which marketplace and plugin to make available on managed developer machines.

Configure the settings to register the official Checkmarx marketplace and enable cx-devassist:

{
  "enabledPlugins": {
    "cx-devassist@cx-devassist-marketplace": true
  },
  "extraKnownMarketplaces": {
    "cx-devassist-marketplace": {
      "source": {
        "source": "github",
        "repo": "Checkmarx/cx-agentic-ai",
        "ref": "master"
      }
    }
  }
}

This configuration:

With this configuration, the plugin is delivered directly from the official Checkmarx repository. Developers provide their Checkmarx One URL and tenant during initial authentication.

Deploy the managed settings using the one method you chose in Deployment Methods.Deployment Methods

Verify the deployment on a test machine before rolling it out broadly.

Managed settings are read when Claude Code starts. After changing a managed-settings deployment, restart Claude Code (or run /reload-plugins for plugin/hook updates) to pick up the change.

Audit logs, if enabled, are written to:

~/.checkmarx/agent-logs/claude/cx-devassist.jsonl

The Claude marketplace manifest lives at .claude-plugin/marketplace.json in the repo root.

In the internal repository, edit:

plugins/cx-devassist/config/cx-onboarding.properties

Uncomment and set both values (both are required for pre-fill to work):

cx_base_auth_uri=https://eu.ast.checkmarx.net
cx_tenant=your-org-tenant

Use the Checkmarx One base authentication URL for your region or your on-premises deployment.

You can find the tenant in Checkmarx One under Settings → Identity and Access Management → General Settings (Display Name), or in the Checkmarx One welcome email.

Update the marketplace source in the managed settings to reference the internal repository and the branch or tag used for the deployment:

{
  "enabledPlugins": {
    "cx-devassist@cx-devassist-marketplace": true
  },
  "extraKnownMarketplaces": {
    "cx-devassist-marketplace": {
      "source": {
        "source": "github",
        "repo": "YourOrg/cx-agentic-ai",
        "ref": "mdm-v1"
      }
    }
  }
}

The marketplace name can remain cx-devassist-marketplace (from .claude-plugin/marketplace.json) when using a fork — only repo and ref need to change. If you rename the marketplace in your fork's marketplace.json, update both the marketplace key and the enabledPlugins entry to match.

Claude Code's git-source marketplaces support pinning by ref (branch or tag), not by commit sha.

Deploy the updated managed settings through the same method described in Step 2 — Deploy the Settings.

On a test machine:

When Checkmarx publishes an updated version:

Do not edit cx-onboarding.properties directly in a developer's installed plugin directory (~/.claude/plugins/...). Installed plugin files can be overwritten during an update.

Managed enabledPlugins entries cannot be disabled through a developer's local settings. Change the managed policy to change the organization-wide plugin configuration.

Claude Code also supports "allowManagedMcpServersOnly": true, which restricts MCP servers to those declared in managed settings.

Because cx-devassist uses the Checkmarx MCP server, ensure any MCP allowlist used by your organization permits the Checkmarx MCP server.

If your organization does not need MCP restrictions, this setting is not required for the Checkmarx deployment.

Claude Code managed settings provide additional controls such as "allowManagedPluginsOnly": true, which restricts installable plugins to those declared in managed settings.

Use these settings according to your organization's Claude Code security policy. They are not Checkmarx-specific requirements.

For the complete set of available controls and their syntax, see the Claude Code settings reference.