Checkmarx FAQs

Question 1

What types of security findings are supported?

Accepted Answer

The tool supports retrieving detailed findings from SAST (Static Application Security Testing), SCA (Software Composition Analysis), and KICS (Infrastructure-as-Code Security) scans. You can access full data flow for SAST issues and CVE chains for SCA vulnerabilities.

Question 2

What is Checkmarx's programmatic integration?

Accepted Answer

This tool provides a programmatic interface for AI coding agents and automated workflows to interact with the Checkmarx One security platform. It allows for managing projects, triggering scans, and retrieving security findings directly through an API.

Question 3

What security operations can I automate with this tool?

Accepted Answer

You can automate a wide range of security tasks, including triggering SAST and SCA scans from Git repositories or local directories, listing projects and scans, and filtering detailed security findings by severity, type, or state. It also allows retrieving full data flow for SAST findings and CVE chains for SCA.

Question 4

How does this benefit AI coding agents or developers?

Accepted Answer

It empowers AI coding agents to seamlessly integrate security into the development lifecycle by providing direct access to Checkmarx One. Developers can use it to automate security testing, quickly triage vulnerabilities, and even get code fix suggestions, accelerating secure development.

Question 5

How can I integrate this into my existing environment?

Accepted Answer

Integration is flexible, supporting `npx` for CLI clients, HTTP mode for remote connections, and Docker deployments. It's designed for use with AI coding platforms like Claude Code and Cursor, making it easy to embed security automation into various development workflows.

Checkmarx

Checkmarx

Características Principales

Casos de Uso

Características Principales

Casos de Uso