How to Use the Checkmarx MCP in Claude

Q: Can Claude Desktop trigger new Checkmarx scans?

Yes. The agent uses the runscan tool to queue new analysis jobs on specific branches. You get the new scan ID back instantly to track its progress.

Connect Claude Desktop directly to Checkmarx One to run security scans and analyze vulnerabilities without leaving your chat window.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Checkmarx MCP to Claude Desktop

Create your Vinkius account to connect Checkmarx to Claude Desktop and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Checkmarx with Claude Desktop

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Run and monitor scans in Claude Desktop

Your agent can kick off fresh security checks right from the conversation using `run_scan`. It targets specific branches and queues the job in Checkmarx One immediately. If someone pushes a new commit while that job is running, you just tell Claude to hit `cancel_scan` to kill the redundant process. Tracking progress takes seconds instead of clicking through web dashboards. The Checkmarx MCP Server checks `list_scans` to see if your job is completed, running, or failed. You get exact timestamps and branch targets fed straight back into your chat interface.

Pull vulnerability details via MCP Server

Finding out what broke the build is usually a massive pain. Claude bypasses the portal entirely by calling `get_scan_results` to download the specific SAST findings. You see the severity levels, current triage states, and the exact lines of code where the flaw exists. Infrastructure as code gets dedicated attention too. When you need to check Terraform or Kubernetes YAML files, the agent grabs `get_kics_results`. This isolates cloud misconfigurations from typical application flaws so you fix your deployment scripts faster.

Find the best fix locations automatically

Security reports often dump hundreds of nodes for a single vulnerability path. Claude uses `list_bfl` to pinpoint the exact spot in your codebase where patching will resolve the entire chain. You just provide the scan and query IDs. Navigating massive enterprise setups is built right in. The agent explores your organizational structure by hitting `list_applications` to find logical product groupings. From there, it maps out individual repositories using `list_projects` to ensure it targets the correct source control context.

Setup guide

Set up Checkmarx MCP in Claude Web or Desktop

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.
2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.
3

Start a conversation

Open a new chat. The Checkmarx MCP tools are available immediately — no restart needed.

Endpoint URL

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

No configuration file needed — paste the URL directly in the Claude web interface.

Available on Free (1 connector), Pro, Max, Team, and Enterprise plans.

Prerequisites

Claude Desktop installed (macOS or Windows)
Active Vinkius subscription with a valid endpoint token

1

Open Claude Desktop Settings

Click the menu icon at the top-left corner, go to Settings → Developer → Edit Config. This opens claude_desktop_config.json in your default text editor.
2

Paste the Checkmarx MCP configuration

Copy the JSON snippet on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Restart Claude Desktop

Close and reopen the application. Claude needs a full restart to load new MCPs — refreshing a conversation is not enough.
4

Verify the connection

Open a new conversation. Click the 🔌 icon at the bottom of the message input. You should see tools listed under checkmarx-mcp.

json

{
  "mcpServers": {
    "checkmarx-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Checkmarx. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Checkmarx now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Checkmarx MCP in Claude Desktop

Open your Claude Desktop settings and click Developer, then Edit Config. Add the server command to the mcpServers section of your configuration file. Save the changes and fully restart the app to see the hammer icon appear.

Yes. The agent uses the run_scan tool to queue new analysis jobs on specific branches. You get the new scan ID back instantly to track its progress.

The tools only fetch vulnerability metadata and specific lines of code flagged by the engines. Your entire codebase remains securely within your source control and Checkmarx environments.

Ask your agent to review your KICS results. It pulls dedicated findings for Terraform, CloudFormation, and Dockerfiles separate from your standard application code.

Vinkius routes the exact lines of code and severity states through an isolated V8 sandbox. The ephemeral connection drops immediately after Claude receives the scan results. No persistent storage retains your security findings.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript