# Checkmarx MCP for AI Agents AI Agent Connect > Checkmarx lets you put your AppSec workflow directly into your AI agent. It connects to Checkmarx One so you can trigger SAST/SCA scans, triage severe vulnerabilities, and find the exact lines of code for fixes without leaving your workspace. It also handles Infrastructure as Code (IaC) results through KICS, giving you a unified way to manage security posture through natural conversation. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_thwJCCvAxQj2dRXly3vkJnbbHvTu7jJNcAvioyvo/ai-agent-connect - **Tags:** appsec, sast, sca, code-scanning, cybersecurity, devsecops ## Description Managing application security usually feels like a chore of jumping between security dashboards and development environments. You find a vulnerability in a report, then have to hunt down the right branch, find the specific line of code, and figure out how to fix it without breaking anything. This Connector changes that by bringing your Checkmarx One environment into your AI agent. Instead of manual navigation, you can just ask your agent to list your projects, trigger new scans on specific branches, or pull the latest infrastructure results for your Terraform files. It handles the heavy lifting of data retrieval so you can focus on the actual remediation. You can quickly identify where a flaw lives and use the Best Fix Location data to see exactly where a patch should go. It's a way to make security a conversation rather than a series of clicks. When you use this through the Vinkius catalog, you're essentially giving your agent a direct line to your enterprise security posture. You get to stay in your flow whether you're triaging a backlog of issues or investigating a new production alert. This setup removes the friction of manual data entry and lets you move from finding a bug to fixing a bug in a single session. ## Tools ### list_projects View all projects, their metadata, and their assigned application links. ### get_project Pull specific details for a project to ensure you're scanning the right branch. ### get_kics_results Fetch infrastructure-specific findings like Terraform or Kubernetes misconfigurations. ### list_applications See all applications and their aggregated risk metrics in your environment. ### list_scans See a history of all active and completed scans for a project. ### run_scan Start a new code scan and get the ID for tracking. ### get_scan_details Check the status and engine results of a specific scan. ### get_scan_results Download the full list of vulnerabilities and their locations from a finished scan. ### cancel_scan Stop an active scan to save resources or because you've pushed a new commit. ### list_bfl Get the best fix location for a specific vulnerability based on a rule ID. ## Prompt Examples **Prompt:** ``` What are the most critical vulnerabilities in my last scan? ``` **Response:** ``` ### Recent Scan Results (Scan #4521) | Severity | Issue | Location | | --- | --- | --- | | **Critical** | SQL Injection | `/api/users.js:142` | | **Critical** | SQL Injection | `/auth/login.ts:87` | | **High** | XSS | `/ui/home.tsx:22` | I found 12 total vulnerabilities. Would you like me to pull the Best Fix Location for the SQL injections? ``` **Prompt:** ``` Trigger a new SAST scan on the 'web-api' project. ``` **Response:** ``` ### Scan Initiated * **Project:** web-api * **Status:** Queued * **Scan ID:** #4522 * **Estimated Time:** ~8 minutes I'll notify you as soon as the results are ready for review. ``` **Prompt:** ``` Where is the best place to fix the SQL injection in the login module? ``` **Response:** ``` ### Best Fix Location Analysis For the SQL injection found in `auth/login.ts:87`, the analysis shows the root cause is at **line 82**. **Root Cause:** User input flows unsanitized into the query builder at this line. **Recommended Action:** Replace the string concatenation with a prepared statement or a parameterized query. ``` ## Capabilities ### Trigger SAST and SCA scans Start new security checks on specific code repositories or branches. ### Triage security vulnerabilities Pull data on severity, state, and specific lines of code for flaws. ### Find best fix locations Get the exact optimal spot in your code to apply a patch for a specific bug. ### Monitor IaC misconfigurations View KICS results for Terraform, Dockerfiles, and Kubernetes YAMLs. ### Manage scan lifecycles Cancel redundant jobs or check the progress of currently running scans. ### Inventory projects and apps List all applications and codebase projects within your Checkmarx One environment. ## Use Cases ### Triage a new security alert A security engineer asks the agent to list the most severe flaws in the last scan and then pulls the best fix location for the top three. ### Pre-deployment IaC check A DevOps engineer asks the agent to check KICS results for a new Terraform branch to catch misconfigurations before merging. ### Rapid bug fixing A developer finds a SQL injection and asks the agent to find the best fix location so they can rewrite the sanitization logic immediately. ### Scan management A developer pushes a new commit and asks the agent to cancel the redundant scan currently running on the old branch. ## Benefits - Stop context-switching between dashboards by using list_scans and get_scan_results directly in your agent. - Speed up remediation by using list_bfl to identify the exact line of code where a patch should live. - Improve IaC security by pulling KICS findings for Terraform and Kubernetes with get_kics_results. - Manage your security pipeline more efficiently by using run_scan and cancel_scan to control your queue. - Get a clear overview of your risk posture across multiple microservices by using list_applications. ## How It Works The bottom line is you get a direct command line to your security scans and vulnerability data without leaving your chat interface. 1. Subscribe to the Checkmarx MCP via the Vinkius catalog. 2. Provide your Checkmarx One JWT Token to authorize the connection. 3. Ask your AI agent to perform actions like listing projects or running a scan. ## Frequently Asked Questions **Can I use Checkmarx MCP to find where to fix a bug?** Yes, this Connector pulls Best Fix Location data directly. Your agent can tell you the exact line of code where a flaw lives and suggest the optimal spot to apply a patch. **Does Checkmarx MCP support Infrastructure as Code?** Yes, it includes KICS results. You can ask your agent to check for misconfigurations in your Terraform, Kubernetes YAMLs, and Dockerfiles. **How do I connect Checkmarx to my AI agent?** You can connect it by subscribing to the Connector via Vinkius and providing your Checkmarx One JWT Token. Once connected, your agent can perform all scan and triage actions. **Can I cancel a scan that is taking too long?** Yes, you can ask your agent to cancel an active scan. This helps you save resources if you've pushed a new commit that makes the current scan redundant. **Does this work with my existing Checkmarx One account?** Yes, this Connector is designed to connect to your existing Checkmarx One enterprise environment, giving your AI agent programmatic access to your existing security posture. **Can I see my Terraform misconfigurations?** Yes, by pulling KICS results, your agent can identify specific infrastructure misconfigurations in your Terraform files and report them back to you instantly. **How can the AI help me fix a vulnerability faster?** Once an issue is identified via scan results, ask your agent to pull the 'Best Fix Location' (BFL) using the query ID. Checkmarx mathematically finds the common root code block, and your AI can instantly rewrite that exact block to sanitize the flaw. You save hours tracing code paths. **Can the agent initiate a static code scan independently?** Yes! Tell the agent to 'Run a scan on project ID X targeting the main branch'. It initiates the analysis array natively across Checkmarx One engines. You can poll for completion status later and retrieve the new dataset directly via chat. **Does it segregate AppSec results from Cloud infrastructure flaws?** It does. Application flaws are pulled cleanly via `get_scan_results`, whereas misconfigurations tied to Docker, Kubernetes, or Terraform limits use a dedicated `get_kics_results` pipeline. The agent intrinsically separates the context for your DevOps team.