You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<h3align="center">Checkmarx VS Code Extension</h3>
20
+
<h3align="center">Also supported for: Cursor, Windsurf and Kiro</h3>
20
21
<palign="center">
21
22
<a href="https://checkmarx.com/resource/documents/en/34965-68742-checkmarx-one-vs-code-extension--plugin-.html"><strong>Explore the docs »</strong></a>
22
23
<br />
@@ -28,10 +29,10 @@
28
29
<summary>Table of Contents</summary>
29
30
<ol>
30
31
<li><a href="#overview">Overview</a></li>
31
-
<li><a href="#checkmarx-one-results">Checkmarx One Results</a></li>
32
+
<li><a href="#checkmarx-one-platform">Checkmarx One Platform</a></li>
> ⭐ Although this plugin was developed for VS Code, the plugin has been tested and found to be effective for use in Cursor, Windsurf and Kiro. This document was written for the VS Code plugin, and applies equally to the other supported IDEs. Any information that applies **only** to VS Code, and not to the other supported IDEs, is noted explicitly.
43
45
44
46
Checkmarx continues to spearhead the shift-left approach to AppSec by bringing our powerful AppSec tools into your IDE. This empowers developers to identify vulnerabilities and remediate them **as they code**. The Checkmarx Visual Studio Code plugin integrates seamlessly into your IDE, identifying vulnerabilities in your proprietary code, open source dependencies, and IaC files. The plugin offers actionable remediation insights in real-time.
45
47
46
-
The Checkmarx Visual Studio Code extension contains three separate tools:
48
+
The Checkmarx Visual Studio Code extension contains four separate capabilities:
47
49
48
-
- Checkmarx One Results
50
+
- Checkmarx One Platform
51
+
52
+
- Checkmarx Developer Assist
49
53
50
54
- KICS Realtime Scanner
51
55
52
56
- Checkmarx SCA Realtime Scanner
53
57
54
58
> The plugin is available on [marketplace](https://marketplace.visualstudio.com/items?itemName=checkmarx.ast-results). In addition, the code can be accessed [here](https://github.com/Checkmarx/ast-vscode-extension).
55
59
56
-
## Checkmarx One Results
60
+
### Support for VS Code-compatible IDEs
61
+
Although this plugin was developed for VS Code, the plugin has been tested and found to be effective for use in the following VS Code-compatible IDEs:
62
+
-**Cursor**
63
+
-**Windsurf**
64
+
-**Kiro** (compatible with version 2.44.0 and above of this extension)
65
+
66
+
67
+
## Checkmarx One Platform
57
68
58
-
This tool enables Checkmarx One users to access the full functionality of your Checkmarx One account directly from your IDE. You can run new scans or import results from scans run in your Checkmarx One account. Checkmarx provides detailed info about each vulnerability, including remediation recommendations and examples of effective remediation.
69
+
This tool enables Checkmarx One users to access the full functionality of your Checkmarx One account (SAST, SCA, IaC, and Secret Detection) directly from your IDE. You can run new scans or import results from scans run in your Checkmarx One account. Checkmarx provides detailed info about each vulnerability, including remediation recommendations and examples of effective remediation. The plugin enables you to navigate from a vulnerability to the relevant source code, so that you can easily zero-in on the problematic code and start working on remediation. <br>
59
70
60
-
The extension enables you to navigate from a vulnerability to the relevant source code, so that you can easily zero-in on the problematic code and start working on remediation. This tool requires authentication, using credentials from your Checkmarx One account.
71
+
These features require authentication, using an API Key or login credentials for your Checkmarx One account.
61
72
62
73
63
74
**GIF - Running a Scan from the IDE**
@@ -68,37 +79,74 @@ The extension enables you to navigate from a vulnerability to the relevant sourc
68
79
69
80
### Key Features
70
81
71
-
- Access the full power of Checkmarx One (SAST, SCA, IaC Security and Secret Detection) directly from your IDE.
82
+
- Access the Checkmarx One platform directly from your IDE.
83
+
- Run a new scan from your IDE even before committing the code, or import scan results from your Checkmarx One account.
84
+
- Rescan an existing branch from your IDE or create a new branch in Checkmarx One for the local branch in your workspace.
85
+
- Provides actionable results including remediation recommendations. Navigate from the results panel directly to the highlighted vulnerable code in the editor and get right down to work on the remediation.
86
+
- Connect to Checkmarx via **API Key** or **OAuth user login** flow.
87
+
- View information about how to remediate **SAST vulnerabilities**, including code samples.
88
+
- Group and filter results.
89
+
- Triage results — edit the result predicate (severity, state, and comments) directly from the Visual Studio Code console (currently supported for **SAST**, **SCA** and **IaC Security**).
90
+
- Links to Codebashing lessons.
91
+
- Apply Auto Remediation to automatically remediate open source vulnerabilities by updating to a non-vulnerable package version.
92
+
-**“AI Security Champion”** harnesses the power of AI to help you understand the vulnerabilities in your code and resolve them quickly and easily (currently supported for **SAST** and **IaC Security** vulnerabilities).
93
+
- Shows [Application Security Posture Management (ASPM)](https://docs.checkmarx.com/en/34965-281716-application-security-posture-management.html) results in the IDE.
94
+
95
+
---
72
96
73
-
- Run a new scan from your IDE even before committing the code, or import scan results from your Checkmarx One account.
97
+
### Prerequisites
74
98
75
-
- Rescan an existing branch from your IDE or create a new branch in Checkmarx One for the local branch in your workspace.
99
+
- An installation of a supported IDE. (**For VS Code**: VS Code version 1.63.0 or above)
100
+
101
+
- You have access to Checkmarx One via:
102
+
- an **API Key** (see [*Generating an API Key*](https://docs.checkmarx.com/en/34965-68618-generating-an-api-key.html#UUID-f3b6481c-47f4-6cd8-9f0d-990896e36cd6_UUID-39ccc262-c7cb-5884-52ed-e1692a635e08)), OR
103
+
- login credentials (**Base URL**, **Tenant name**, **Username**, and **Password**)
76
104
77
-
- Provides actionable results including remediation recommendations. Navigate from results panel directly to the highlighted vulnerable code in the editor and get right down to work on the remediation.
105
+
> In order to use this integration for running an end-to-end flow of scanning a project and viewing results, the API Key or user account must have at a minimum the out-of-the-box composite role `ast-scanner` as well as the IAM role `default-roles`.
78
106
79
-
- View info about how to remediate SAST vulnerabilities, including code samples
107
+
-**git** is installed on your local machine. For installation instructions, see [here](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git).
80
108
81
-
- Group and filter results
109
+
- To use **AI Generated Remediation**, you must have an **API Key for your GPT account**
110
+
(unless your account is configured to use Azure AI; see [*Configuring Plugin Settings*](https://docs.checkmarx.com/en/34965-324314-plugins-settings.html#UUID-ea5638d0-3673-520c-79e0-085f92d4a2dc_id_ConfiguringScannerDefaultSettings-OpenScannerDefaultSettings)).
82
111
83
-
- Triage results - edit the result predicate (severity, state and comments) directly from the Visual Studio Code console
112
+
### Installation
84
113
85
-
- Links to Codebashing lessons
114
+
1. Install the **Checkmarx** extension from the Marketplace.
115
+
2. In the IDE, open Checkmarx One Settings, click on **Authentication**, and enter your API Key or login credentials to enable all Checkmarx One features.
116
+
3. Configure additional Checkmarx One settings as described in Checkmarx [documentation](https://docs.checkmarx.com/en/34965-123549-installing-and-setting-up-the-checkmarx-vs-code-extension.html).
86
117
87
-
- Apply Auto Remediation to automatically remediate open source vulnerabilities, by updating to a non-vulnerable package version.
118
+
**GIF – Installing and Setting Up the Extension**
119
+
88
120
89
-
- "AI Guided Remediation" harnesses the power of AI to help you to understand the vulnerabilities in your code, and resolve them quickly and easily.
121
+
### Usage
122
+
* Learn about using Checkmarx One features [here](https://docs.checkmarx.com/en/34965-68743-using-the-checkmarx-vs-code-extension---checkmarx-one-results.html)
90
123
91
-
- AI Secure Coding Assistant (ASCA) - A lightweight scan engine that runs in the background while you work, enabling developers to identify and remediate secure coding best practice violations as they code.
124
+
---
92
125
126
+
## Checkmarx Developer Assist
127
+
Developer Assist is an agentic AI tool that delivers real-time context-aware prevention, remediation, and guidance to developers inside the IDE.
128
+
<br>
129
+
### Key Features
130
+
- An advanced security agent that delivers real-time context-aware prevention, remediation, and guidance to developers from the IDE.
131
+
- Realtime scanners identify risks as you code.
132
+
- AI Secure Coding Assistant (ASCA), a lightweight source code scanner, enables developers to identify secure coding best practice violations in the file that they are working on as they code.
133
+
- Specialized realtime scanners identify vulnerable open source packages and container images, as well as exposed secrets and IaC risks.
134
+
- MCP-based agentic AI remediation.
135
+
- AI powered explanation of risk details.
93
136
### Prerequisites
94
-
- An installation of VS Code version 1.63.0 or above
137
+
- Either a **Developer Assist Access Key** OR
138
+
- Credentials for a Checkmarx One account with a **Checkmarx One Assist** license, and with the **Checkmarx MCP** activated for your tenant account in the Checkmarx One UI under **Settings → Plugins**. This must be done by an account admin.
139
+
-**For VS Code**: Supported for VS Code version **1.100.0** or above
140
+
(supports both `settings.json` (v1.100–1.101) and `mcp.json` (v1.102+))
141
+
-**For VS Code**: You must have **GitHub Copilot** installed
142
+
### Installation
143
+
1. Install the **Checkmarx** extension from the Marketplace.
144
+
2. In the IDE, open Checkmarx Settings, click on **Authentication**, and enter your Access Key or login credentials.
95
145
96
-
- You have an **API Key** for your Checkmarx One account. To create an API key, see [Generating an API Key](https://checkmarx.com/resource/documents/en/34965-68618-generating-an-api-key.html).
97
-
> In order to use this integration for running an end-to-end flow of scanning a project and viewing results, the API Key must have at a minimum the out-of-the-box composite role `ast-scanner` as well as the IAM role `default-roles`.
146
+
### Usage
147
+
* Learn about using Checkmarx Developer Assist [here](https://docs.checkmarx.com/en/34965-474001-using-the-checkmarx-vs-code-extension---dev-assist.html)
98
148
99
-
- "git" is installed on your local machine. For installation instructions, see [here](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git).
100
-
101
-
- In order to use **AI Generated Remediation**, you need to have an API Key for your GPT account.
149
+
**GIF - AI Remediation with Developer Assist**
102
150
103
151
## KICS Realtime Scanner
104
152
@@ -117,14 +165,20 @@ This tool initiates KICS scans directly from their VS Code console. The scan run
117
165
118
166
- Apply Auto Remediation to automatically fix IaC vulnerabilities
119
167
120
-
- AI Guided Remediation”harnesses the power of AI to help you to understand the vulnerabilities in your code, and resolve them quickly and easily.
168
+
-"AI Guided Remediation”harnesses the power of AI to help you to understand the vulnerabilities in your code, and resolve them quickly and easily.
121
169
122
170
### Prerequisites
123
171
124
172
- You must have a supported container engine (e.g., Docker, Podman etc.) installed and running in your environment.
125
173
126
174
- In order to use **AI Generated Remediation**, you need to have an API Key for your GPT account.
127
175
176
+
### Installation
177
+
178
+
1. Install the **Checkmarx** extension from the Marketplace.
179
+
> No additional setup is required — KICS Realtime Scanner works automatically once the extension is installed.
180
+
2. If you would like to customize the scan parameters, enter the desired flags in the Additional Parameters field. For a list of available options, see [Scan Command Options](https://docs.checkmarx.com/en/34965-123549-installing-and-setting-up-the-checkmarx-vs-code-extension.html).
181
+
128
182
## Checkmarx SCA Realtime Scanner
129
183
130
184
This tool enables VS Code users to initiate SCA scans directly from their VS Code console, and shows detailed results as soon as the scan is completed. The scan identifies the open-source dependencies used in your code and indicates the security risks associated with those packages. The identified packages are shown in a tree structure with an indication of the risk level for each package. You can drill down to show the specific vulnerabilities associated with a package. This is a **free tool** provided by Checkmarx for all VS Code users, and does not require the user to submit credentials for a Checkmarx One account.
@@ -143,35 +197,22 @@ This tool enables VS Code users to initiate SCA scans directly from their VS Cod
143
197
144
198
- In order to get comprehensive results, you need to install all relevant package managers on your local environment, see [Installing Supported Package Managers](https://checkmarx.com/resource/documents/en/34965-19198-installing-supported-package-managers-for-resolver.html).
145
199
146
-
## Initial Setup
147
-
1. Verify that all prerequisites are in place.
148
-
149
-
2. Install the extension from Marketplace.
150
-
151
-
3. Configure the extension settings as follows:
152
-
- For **KICS Realtime Scanner** and **SCA Realtime Scanner** - no
153
-
configuration needed.
154
-
- For SCA Realtime Scanning, if your environment doesn't have access to the internet, then you will need to configure a proxy server in the Settings, under **Checkmarx One: Additional Params**.
155
-
156
-
- For **Checkmarx One Results** - use your Checkmarx One API Key to integrate with your Checkmarx One account, as described [here](https://checkmarx.com/resource/documents/en/34965-123549-installing-and-setting-up-the-checkmarx-vs-code-extension.html#UUID-b74024dd-5f0e-cac7-668c-94049b9d8566_id_VisualStudioCode-ASTResults-SettinguptheExtension).
157
-
158
-
- If you would like to use **AI Guided Remediation**, use your GPT API Key to integrate with your GPT account, as described [here](https://checkmarx.com/resource/documents/en/34965-123549-installing-and-setting-up-the-checkmarx-vs-code-extension.html#UUID-b74024dd-5f0e-cac7-668c-94049b9d8566_section-idm4543400890995233753488463936).
159
-
200
+
### Installation
160
201
161
-
**GIF - Installing and Setting up the Extension**
162
-
![Installing and Setting up the Extension](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_installation_and_initial_setup.gif"Installing and Setting up the Extension")
202
+
1. Install the **Checkmarx** extension from the Marketplace.
203
+
> No configuration is required for SCA Realtime Scanning in most environments.
163
204
164
205
## Contributing
165
206
166
207
We appreciate feedback and contribution to the VsCode extension! Before you get started, please see the following:
0 commit comments