diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json new file mode 100644 index 0000000..6bd261f --- /dev/null +++ b/.cursor-plugin/marketplace.json @@ -0,0 +1,19 @@ +{ + "name": "cx-cursor-marketplace", + "owner": { + "name": "Checkmarx" + }, + "metadata": { + "description": "Official Checkmarx MCP Plugin For Cursor IDE", + "version": "1.0.0" + }, + "plugins": [ + { + "name": "checkmarx", + "displayName": "Checkmarx", + "description": "Checkmarx-powered security scanning and fixing inside your coding loop. Checks the code you write and the code AI generates for vulnerabilities and risky dependencies, then returns precise, engine-backed fixes. Best invoked after writing or changing code, before commits, and around security-sensitive logic. Applies fixes inline so you can accept them without leaving your editor.", + "category": "security", + "source": "./plugins/cx-cursor-plugin" + } + ] +} diff --git a/docs/authentication.md b/docs/authentication.md index e2b8bae..0d770f6 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -35,7 +35,7 @@ Pass the API key in the `Authorization` header when configuring your MCP client. ```json { "Checkmarx": { - "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}", + "serverUrl": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}", "headers": { "cx-origin": "", "Authorization": "API_KEY" @@ -74,13 +74,13 @@ For OAuth2, your MCP client config only needs the server URL: { "mcpServers": { "Checkmarx": { - "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}" + "serverUrl": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}" } } } ``` -Replace `{api_host}` and `{tenant}` with your values. +Replace `{cxone_base_url}` and `{tenant}` with your values. **OAuth2 discovery endpoints exposed by the server:** - `/.well-known/oauth-protected-resource` diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 22b4768..9b06884 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -20,11 +20,11 @@ Common issues and solutions when using the Checkmarx Security MCP Server. **Symptoms:** Client shows "server not reachable", connection timeout, or no tools listed. **Checks:** -1. Verify the server URL in your config matches the pattern `https://{api_host}/api/security-mcp/mcp/{tenant}`. -2. Confirm your `api_host` value (e.g., `ast.checkmarx.net`) — get this from your Checkmarx administrator. +1. Verify the server URL in your config matches the pattern `https://{cxone_base_url}/api/security-mcp/mcp/{tenant}`. +2. Confirm your `cxone_base_url` value (e.g., `ast.checkmarx.net`) — get this from your Checkmarx administrator. 3. Confirm your `tenant` value (e.g., `cx_eu`, `checkmarx`). 4. Check that your network allows outbound HTTPS traffic to the Checkmarx API host. -5. Test basic connectivity: `curl -I https://{api_host}/api/security-mcp/mcp/{tenant}`. +5. Test basic connectivity: `curl -I https://{cxone_base_url}/api/security-mcp/mcp/{tenant}`. **Common mistakes:** - Trailing slash in the URL (remove it). diff --git a/examples/claude-mcp.json b/examples/claude-mcp.json index ef0fb50..528d31b 100644 --- a/examples/claude-mcp.json +++ b/examples/claude-mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "Checkmarx": { "type": "http", - "url": "https://{api_host}/api/security-mcp/mcp/{tenant}", + "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}", "headers": { "cx-origin": "Claude", "Authorization": "{api_key}" diff --git a/examples/copilot-mcp.json b/examples/copilot-mcp.json index 7ba3872..1fe8e7e 100644 --- a/examples/copilot-mcp.json +++ b/examples/copilot-mcp.json @@ -1,7 +1,7 @@ { "servers": { "Checkmarx": { - "url": "https://{api_host}/api/security-mcp/mcp/{tenant}", + "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}", "requestInit": { "headers": { "cx-origin": "Jetbrains", diff --git a/examples/cursor-mcp.json b/examples/cursor-mcp.json index 89fb346..d3c9296 100644 --- a/examples/cursor-mcp.json +++ b/examples/cursor-mcp.json @@ -1,7 +1,7 @@ { "mcpServers": { "Checkmarx": { - "url": "https://{api_host}/api/security-mcp/mcp/{tenant}", + "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}", "headers": { "cx-origin": "Cursor", "Authorization": "{api_key}" diff --git a/examples/kiro-mcp.json b/examples/kiro-mcp.json index b3df312..9e73b2c 100644 --- a/examples/kiro-mcp.json +++ b/examples/kiro-mcp.json @@ -1,7 +1,7 @@ { "mcpServers": { "Checkmarx": { - "url": "https://{api_host}/api/security-mcp/mcp/{tenant}", + "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}", "headers": { "cx-origin": "Kiro", "Authorization": "{api_key}" diff --git a/examples/windsurf-mcp.json b/examples/windsurf-mcp.json index 0dee098..b9527c2 100644 --- a/examples/windsurf-mcp.json +++ b/examples/windsurf-mcp.json @@ -1,7 +1,7 @@ { "mcpServers": { "Checkmarx": { - "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}", + "serverUrl": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}", "headers": { "cx-origin": "Windsurf", "Authorization": "{api_key}" diff --git a/mcp/mcp.json b/mcp/mcp.json deleted file mode 100644 index ec4a4cf..0000000 --- a/mcp/mcp.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "mcpServers": { - "Checkmarx": { - "url": "https:///api/security-mcp/mcp/", - "headers": { - "cx-origin": "", - "Authorization": "" - } - } - } -} diff --git a/plugins/cx-cursor-plugin/.cursor-plugin/plugin.json b/plugins/cx-cursor-plugin/.cursor-plugin/plugin.json new file mode 100644 index 0000000..94ec6a2 --- /dev/null +++ b/plugins/cx-cursor-plugin/.cursor-plugin/plugin.json @@ -0,0 +1,46 @@ +{ + "name": "checkmarx", + "displayName": "Checkmarx", + "version": "1.0.0", + "description": "Checkmarx-powered security scanning and fixing inside your coding loop. Real-time vulnerability detection with AI-powered remediation.", + "author": { + "name": "Checkmarx", + "email": "support@checkmarx.com", + "url": "https://checkmarx.com" + }, + "homepage": "https://checkmarx.com", + "repository": "https://github.com/checkmarx/cx-agentic-ai", + "license": "Apache-2.0", + "logo": "../assets/logo.png", + "keywords": [ + "mcp", + "checkmarx", + "security", + "vulnerability-remediation", + "realtime-scan", + "sast", + "iac", + "sca", + "secrets-detection" + ], + "variables": { + "type": "object", + "properties": { + "CXONE_BASE_URL": { + "type": "string", + "title": "Checkmarx One API Host", + "description": "Your Checkmarx One API host, e.g. ast.checkmarx.net" + }, + "CXONE_TENANT_ID": { + "type": "string", + "title": "Tenant ID", + "description": "Your Checkmarx tenant identifier" + } + }, + "required": ["CXONE_BASE_URL", "CXONE_TENANT_ID"] + }, + "commands": [], + "rules": [], + "skills": [], + "agents": [] +} \ No newline at end of file diff --git a/plugins/cx-cursor-plugin/README.md b/plugins/cx-cursor-plugin/README.md new file mode 100644 index 0000000..354901e --- /dev/null +++ b/plugins/cx-cursor-plugin/README.md @@ -0,0 +1,51 @@ +# Cursor IDE - Checkmarx MCP Setup Guide + +The Checkmarx plugin registers its MCP server automatically through Cursor's plugin marketplace mechanism — no manual `mcp.json` editing, no environment variables, and no restarting your computer. + +## Setup (1 minute) + +1. Install the **Checkmarx** plugin from the Cursor Marketplace (or add this repo's `.cursor-plugin/marketplace.json` as a custom marketplace source). +2. When Cursor prompts you to configure the plugin, fill in: + - **Checkmarx One API Host** — e.g. `ast.checkmarx.net` + - **Tenant ID** — your Checkmarx tenant identifier + - **API Key** *(optional)* — leave blank to authenticate via browser-based OAuth2 login on first use instead +3. Restart Cursor. + +That's it — Cursor reads the plugin's `mcp.json` and registers the `Checkmarx` MCP server for you using the values you entered. + +## Verify + +Ask Cursor: +``` +What MCP servers are available? +``` +or +``` +List all Checkmarx tools +``` + +If you left the API Key blank, the first tool call will open a browser window for you to log in to Checkmarx One. After that, token refresh is handled automatically. + +## Updating configuration later + +Reopen the plugin's configuration panel in Cursor (Settings → Plugins → Checkmarx → Configure) to change your API host, tenant ID, or API key — no file editing required. + +## Troubleshooting + +**MCP not appearing in Cursor** +- Confirm the plugin shows as installed and configured in Settings → Plugins. +- Confirm Cursor was restarted after installing/configuring the plugin. + +**Connection error** +- Double-check the API host (e.g. `ast.checkmarx.net`, no `https://` prefix) and tenant ID. +- Confirm network access to your Checkmarx One tenant. + +**401 Unauthorized** +- If using OAuth2 (API Key left blank), make sure you completed the browser login prompt. +- If using an API key, verify it hasn't expired and that your Checkmarx user has the required permissions. + +See [docs/authentication.md](../../docs/authentication.md) for full authentication details. + +## Getting help + +Contact: support@checkmarx.com diff --git a/plugins/cx-cursor-plugin/assets/logo.png b/plugins/cx-cursor-plugin/assets/logo.png new file mode 100644 index 0000000..9668e98 Binary files /dev/null and b/plugins/cx-cursor-plugin/assets/logo.png differ diff --git a/plugins/cx-cursor-plugin/mcp.json b/plugins/cx-cursor-plugin/mcp.json new file mode 100644 index 0000000..1f51c15 --- /dev/null +++ b/plugins/cx-cursor-plugin/mcp.json @@ -0,0 +1,7 @@ +{ + "mcpServers": { + "Checkmarx": { + "url": "https://${CXONE_BASE_URL}/api/security-mcp/mcp/${CXONE_TENANT_ID}" + } + } +} \ No newline at end of file diff --git a/server.json b/server.json index f01516f..1b737bd 100644 --- a/server.json +++ b/server.json @@ -1,6 +1,6 @@ { "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", - "name": "com.checkmarx/security-mcp", + "name": "com.checkmarx/checkmarx", "description": "Official Checkmarx MCP Server", "repository": { "url": "https://github.com/Checkmarx/cx-agentic-ai", @@ -11,9 +11,9 @@ "remotes": [ { "type": "streamable-http", - "url": "https://{api_host}/api/security-mcp/mcp/{tenant_id}", + "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}", "variables": { - "api_host": { + "cxone_base_url": { "description": "API host provided by your Checkmarx administrator, e.g., ast.checkmarx.net", "isRequired": true },