• TRIAGE
  • REMEDIATION
  • REPORTING
  • HUMAN

How to audit infrastructure as code with your AI

Connect Checkmarx to your AI client once. From there, your agent handles the heavy lifting of scanning and interpreting security findings.

Ask AI about this page

Short answer

How can I use AI to audit my IaC?

Your AI uses the Checkmarx Connector to pull KICS scan results directly into your chat. It identifies misconfigurations in Terraform, Docker, and Kubernetes, then suggests specific fixes. You get a clear breakdown of security gaps and remediation steps.

The results.

Where your findings land.

The AI organizes scan data into actionable categories.

TRIAGE

Security gaps identified

The AI pulls KICS results to highlight exact lines in your Terraform or Kubernetes files that violate security policies.

REMEDIATION

Fixes ready to apply

Your agent generates corrected code snippets based on the specific misconfigurations found in your Dockerfiles or manifests.

REPORTING

Summarized risk levels

The AI groups findings by severity, giving you a high-level view of your infrastructure's security posture.

HUMAN

Final code review

You review the AI's suggested changes before committing them to your repository to ensure they meet your specific logic.

The workflow

What your AI does when the scan results arrive.

The AI acts as a bridge between raw security data and your development environment.

  1. Fetch scan data

    The agent pulls the latest security findings from your Checkmarx instance.

    get_kics_results

  2. Analyze misconfigurations

    The AI parses the KICS output to understand which Terraform or Kubernetes rules were broken.

    get_kics_results

  3. Draft fixes

    Your agent writes the corrected configuration code to resolve the identified vulnerabilities.

    get_kics_results

  4. Verify logic

    The AI compares the new code against the original scan results to ensure the issue is addressed.

    get_kics_results

Try it

Copy these to start.

Use these prompts to kick off an audit.

Starting points

Replace the bracketed text with your specific repository names or file paths.

Checkmarx Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_thwJCCvAxQj2dRXly3vkJnbbHvTu7jJNcAvioyvo/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Checkmarx capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "checkmarx-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_thwJCCvAxQj2dRXly3vkJnbbHvTu7jJNcAvioyvo/mcp"
    }
  }
}
Copy into chat04

  • Get the KICS results for my 'production-infra' repo and list all high-severity issues.

  • Look at the Dockerfile misconfigurations in the 'web-app' container and suggest fixes.

  • Summarize the Kubernetes configuration errors found in the 'cluster-config' folder.

  • Based on the KICS results for my Terraform files, write a plan to fix the open S3 bucket permissions.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Checkmarx once, then ask.

You only need to link your Checkmarx account once. Your credentials stay encrypted, and your AI agent handles the rest.

Connect Checkmarx to your AI

FAQ

How this task behaves.

  • 01

    Can the AI automatically commit fixes to my Git repo?

    No. The AI generates the code and suggests the changes, but you must manually review and commit them.

  • 02

    Does the AI run the KICS scans itself?

    No. The AI uses the `get_kics_results` tool to read data from scans that have already been performed by Checkmarx.

  • 03

    What types of files can it audit?

    It focuses on Terraform, Dockerfiles, and Kubernetes configurations via KICS results.

  • 04

    Can the AI delete my existing infrastructure?

    No. The AI only reads scan data and generates text. It has no capability to execute commands against your cloud provider.

  • 05

    Will it fix my security issues automatically?

    No. It provides the corrected code, but the decision to apply those changes stays with you.

  • More questions about Checkmarx? See everything the Checkmarx Connector can do

Connect Checkmarx to Claude, Cursor, ChatGPT & more