Checkmarx · Official

Checkmarx One MCP server

Plan and run Checkmarx One scans, browse findings and get fix guidance from the agent.

Verified publisher namespaceRemoteSecurity & code quality
Registry name
com.checkmarx/checkmarx
Latest version
1.0.0 · updated 2026-08-13
Links
Vendor docsSource

What the Checkmarx One MCP server can do

From Checkmarx's own MCP documentation.

Authentication

Checkmarx One API key in the Authorization header (endpoint <base_url>/api/security-mcp/mcp), or OAuth with the predefined cx-mcp-client client or Dynamic Client Registration (endpoint <base_url>/api/security-mcp/mcp/{tenantName}).

https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}

Options

  • Manual installs set a cx-origin value: Vscode, Jetbrains, Cursor, Windsurf or Kiro.
  • OAuth setup is documented for Claude CLI, Gemini CLI, Codex CLI, Copilot CLI, Cursor, Kiro, Antigravity and Claude Web/Desktop.
  • Local directory scanning needs the Checkmarx CLI installed and reachable by the MCP.

Tools (19 documented tools)

packageRemediationcodeRemediationimageRemediationplanScantriggerScangetScanDetailsgetLatestScanslistFindingsgetFindingDetailsgetTenantVulnerabilitiesSummaryresolveProjectcreateProjectlistProjectsgetProjectConfiglistApplicationsgetApplicationDetailscreateApplicationassociateProjectlistScans

Good to know

  • Remediation tools need a Checkmarx One Assist, AI Protection or Developer Assist license.
  • Covers SAST, SCA, IaC Security and Secrets only; no triage/state changes and no destructive actions.
  • The predefined OAuth client is not supported for Codex CLI, Copilot CLI, Kiro IDE or Antigravity IDE.
  • Dynamic Client Registration is capped at 500 clients per tenant.
  • CLI and MCP credentials should have matching permissions.
  • associateProject does not accept project UUIDs; long scans keep running in the background and must be checked manually.
Checkmarx MCP docs

Endpoints

  • streamable-http https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}

More security & code quality

SnykSonarQubeSonatype Guide

Get the weekly agent stack update

New official MCP servers, spec changes and harness releases, checked against the source. One email a week, no fluff.

Work at Checkmarx?

Feature Checkmarx One at the top of the security & code quality category and the MCP directory from $49/month.

Feature this server

Add an install badge to the Checkmarx One README

Free. One link that installs the server in Cursor, VS Code, Kiro, LM Studio or Goose with one click, and gives Claude Code, Codex, Gemini CLI and 10 more agents their exact config.

Install in any agent (Markdown)

[![Install with AgentAtlas](https://img.shields.io/badge/install-15_agents-111111)](https://agentatlas.dev/tools/setup-kit?servers=checkmarx)

Listed on AgentAtlas (Markdown)

[![Listed on AgentAtlas](https://img.shields.io/badge/listed_on-AgentAtlas-111111)](https://agentatlas.dev/mcp/checkmarx)

Reviewed Oct 21, 2026. Official means published under Checkmarx's namespace in the MCP registry. It is not a security audit.