Cursor CLI

Team Marketplace installs the plugin bundle (rules, skills, MCP manifest, hook scripts), but Cursor does not automatically merge cx-devassist's security hooks into a developer's hooks.json. This is a separate, required step — without it, the security gate hooks are not active even though the plugin appears installed in Customize.

/cx-install-wiring

# User scope
bash plugins/cursor-devassist/scripts/install-hooks.sh

# Project scope
CX_CURSOR_HOOKS_TARGET=project CX_PROJECT_PATH=/path/to/repo \
  bash plugins/cursor-devassist/scripts/install-hooks.sh

On a test machine enrolled in your Cursor team:

When using Browser sign-in (OAuth), the Checkmarx One URL and tenant are remembered after initial configuration and do not need to be entered for subsequent operations.

Audit logs, if enabled, are written to:

~/.checkmarx/agent-logs/cursor/cx-devassist.jsonl

The Cursor marketplace manifest lives at .cursor-plugin/marketplace.json. Plugin id: cx-devassist · marketplace name: cx-cursor-marketplace.

Private repository access: If your fork is private, install the Cursor GitHub App on the repository so Cursor can index the marketplace. Developers also need GitHub access to clone plugin sources when Cursor resolves the marketplace locally.

In the internal repository, edit:

plugins/cursor-devassist/config/cx-onboarding.properties

Uncomment and set both values (both are required for pre-fill to work):

cx_base_auth_uri=https://eu.ast.checkmarx.net
cx_tenant=your-org-tenant

Use the Checkmarx One base authentication URL for your region or your on-premises deployment.

You can find the tenant in Checkmarx One under Settings → Identity and Access Management → General Settings (Display Name), or in the Checkmarx One welcome email.

Use your on-premises URL if applicable.

If either value is missing or invalid, the plugin falls back to requesting the information from the developer rather than blocking authentication.

Commit and push the change to the branch your Team Marketplace will track.

In Cursor Dashboard → Plugins → Team Marketplaces, update the marketplace's source repository to your fork and pinned branch (for example, YourOrg/cx-agentic-ai at mdm-v1) instead of the official repository.

Deploy through Step 1 — Configure the Team Marketplace and Step 2 — Wire the Security Hooks, pointed at your fork.Step 1 — Configure the Team MarketplaceStep 2 — Wire the Security Hooks (required)

Follow Step 3 — Verify the Deployment. In the authentication step, confirm the agent runs cx auth login with your pre-filled --base-auth-uri and --tenant values — the developer should not be prompted for URL or tenant.Step 3 — Verify the Deployment

When Checkmarx publishes a new upstream version:

Do not edit cx-onboarding.properties in a user's live plugin install cache — it is overwritten on plugin update.

For Required plugins, developers cannot uninstall; Dashboard admins control the version through marketplace refresh.

See Deployment patterns for full policy syntax.

Deploy a .mobileconfig with Cursor policies. Sample profiles ship inside the macOS app bundle:

/Applications/Cursor.app/Contents/Resources/app/policies/

Upload to Jamf, Kandji, or Intune as a custom configuration profile.

Create ~/.cursor/policy.json (Cursor 2.0+):

{
  "AllowedTeamId": "your-team-id",
  "UpdateMode": "none"
}

Deploy via configuration management (Ansible, Puppet, etc.). Changes apply on Cursor restart; the file is watched for updates.

cx-devassist bundles the Checkmarx MCP (cx mcp bridge). If your organization uses MCP allowlists, distribute ~/.cursor/permissions.json through MDM and include Checkmarx remediation tools as needed:

{
  "mcpAllowlist": [
    "Checkmarx:*"
  ]
}

Use the exact MCP server label shown in Customize on a test machine. Team dashboard MCP allowlists take precedence over file-based allowlists — configure both consistently. See Model and integration management — MCP Allowlist and Managing Run Mode allowlists with MDM.

Pair AllowedTeamId with your MCP allowlist so only your organization's Cursor team can use the deployment.

From a terminal:

cursor-agent plugin marketplace add https://github.com/Checkmarx/cx-agentic-ai

Then run /cx-install-wiring and restart the CLI session.

To use a preconfigured internal fork instead, point this at your fork's URL — onboarding pre-fill requires the marketplace to resolve your fork branch with the edited cx-onboarding.properties.

Copy or symlink the plugin folder to:

~/.cursor/plugins/local/cx-devassist-cursor/
├── .cursor-plugin/plugin.json
├── config/cx-onboarding.properties   ← pre-fill here if preconfiguring onboarding
├── hooks/hooks.json
├── mcp.json
└── ...

Restart Cursor, or run Developer: Reload Window (IDE). Run install-hooks.sh and /cx-cli-setup as needed.

This path is useful when no GitHub marketplace connectivity exists. You are responsible for updating the local copy when Checkmarx releases new versions.