AST-157828 cursor marketplace

.cursor-plugin/marketplace.json

@@ -0,0 +1,19 @@
+{
+  "name": "cx-cursor-marketplace",
+  "owner": {
+    "name": "Checkmarx"
+  },
+  "metadata": {
+    "description": "Official Checkmarx MCP Plugin For Cursor IDE",
+    "version": "1.0.0"
+  },
+  "plugins": [
+    {
+      "name": "checkmarx",
+      "displayName": "Checkmarx",
+      "description": "Checkmarx-powered security scanning and fixing inside your coding loop. Checks the code you write and the code AI generates for vulnerabilities and risky dependencies, then returns precise, engine-backed fixes. Best invoked after writing or changing code, before commits, and around security-sensitive logic. Applies fixes inline so you can accept them without leaving your editor.",
+      "category": "security",
+      "source": "./plugins/cx-cursor-plugin"
+    }
+  ]
+}

docs/authentication.md

@@ -35,7 +35,7 @@ Pass the API key in the `Authorization` header when configuring your MCP client.
 ```json
 {
     "Checkmarx": {
-      "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}",
+      "serverUrl": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}",
       "headers": {
         "cx-origin": "<client-name>",
         "Authorization": "API_KEY"
@@ -74,13 +74,13 @@ For OAuth2, your MCP client config only needs the server URL:
 {
   "mcpServers": {
     "Checkmarx": {
-      "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}"
+      "serverUrl": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}"
     }
   }
 }
 ```
 
-Replace `{api_host}` and `{tenant}` with your values.
+Replace `{cxone_base_url}` and `{tenant}` with your values.
 
 **OAuth2 discovery endpoints exposed by the server:**
 - `/.well-known/oauth-protected-resource`

docs/troubleshooting.md

@@ -20,11 +20,11 @@ Common issues and solutions when using the Checkmarx Security MCP Server.
 **Symptoms:** Client shows "server not reachable", connection timeout, or no tools listed.
 
 **Checks:**
-1. Verify the server URL in your config matches the pattern `https://{api_host}/api/security-mcp/mcp/{tenant}`.
-2. Confirm your `api_host` value (e.g., `ast.checkmarx.net`) — get this from your Checkmarx administrator.
+1. Verify the server URL in your config matches the pattern `https://{cxone_base_url}/api/security-mcp/mcp/{tenant}`.
+2. Confirm your `cxone_base_url` value (e.g., `ast.checkmarx.net`) — get this from your Checkmarx administrator.
 3. Confirm your `tenant` value (e.g., `cx_eu`, `checkmarx`).
 4. Check that your network allows outbound HTTPS traffic to the Checkmarx API host.
-5. Test basic connectivity: `curl -I https://{api_host}/api/security-mcp/mcp/{tenant}`.
+5. Test basic connectivity: `curl -I https://{cxone_base_url}/api/security-mcp/mcp/{tenant}`.
 
 **Common mistakes:**
 - Trailing slash in the URL (remove it).

examples/claude-mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "Checkmarx": {
       "type": "http",
-      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
+      "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}",
       "headers": {
         "cx-origin": "Claude",
         "Authorization": "{api_key}"

examples/copilot-mcp.json

@@ -1,7 +1,7 @@
 {
   "servers": {
     "Checkmarx": {
-      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
+      "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}",
       "requestInit": {
         "headers": {
           "cx-origin": "Jetbrains",

examples/cursor-mcp.json

@@ -1,7 +1,7 @@
 {
   "mcpServers": {
     "Checkmarx": {
-      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
+      "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}",
       "headers": {
         "cx-origin": "Cursor",
         "Authorization": "{api_key}"

examples/kiro-mcp.json

@@ -1,7 +1,7 @@
 {
   "mcpServers": {
     "Checkmarx": {
-      "url": "https://{api_host}/api/security-mcp/mcp/{tenant}",
+      "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}",
       "headers": {
         "cx-origin": "Kiro",
         "Authorization": "{api_key}"

examples/windsurf-mcp.json

@@ -1,7 +1,7 @@
 {
   "mcpServers": {
     "Checkmarx": {
-      "serverUrl": "https://{api_host}/api/security-mcp/mcp/{tenant}",
+      "serverUrl": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant}",
       "headers": {
         "cx-origin": "Windsurf",
         "Authorization": "{api_key}"

plugins/cx-cursor-plugin/.cursor-plugin/plugin.json

@@ -0,0 +1,46 @@
+{
+  "name": "checkmarx",
+  "displayName": "Checkmarx",
+  "version": "1.0.0",
+  "description": "Checkmarx-powered security scanning and fixing inside your coding loop. Real-time vulnerability detection with AI-powered remediation.",
+  "author": {
+    "name": "Checkmarx",
+    "email": "support@checkmarx.com",
+    "url": "https://checkmarx.com"
+  },
+  "homepage": "https://checkmarx.com",
+  "repository": "https://github.com/checkmarx/cx-agentic-ai",
+  "license": "Apache-2.0",
+  "logo": "../assets/logo.png",
+  "keywords": [
+    "mcp",
+    "checkmarx",
+    "security",
+    "vulnerability-remediation",
+    "realtime-scan",
+    "sast",
+    "iac",
+    "sca",
+    "secrets-detection"
+  ],
+  "variables": {
+    "type": "object",
+    "properties": {
+      "CXONE_BASE_URL": {
+        "type": "string",
+        "title": "Checkmarx One API Host",
+        "description": "Your Checkmarx One API host, e.g. ast.checkmarx.net"
+      },
+      "CXONE_TENANT_ID": {
+        "type": "string",
+        "title": "Tenant ID",
+        "description": "Your Checkmarx tenant identifier"
+      }
+    },
+    "required": ["CXONE_BASE_URL", "CXONE_TENANT_ID"]
+  },
+  "commands": [],
+  "rules": [],
+  "skills": [],
+  "agents": []
+}

plugins/cx-cursor-plugin/README.md

@@ -0,0 +1,51 @@
+# Cursor IDE - Checkmarx MCP Setup Guide
+
+The Checkmarx plugin registers its MCP server automatically through Cursor's plugin marketplace mechanism — no manual `mcp.json` editing, no environment variables, and no restarting your computer.
+
+## Setup (1 minute)
+
+1. Install the **Checkmarx** plugin from the Cursor Marketplace (or add this repo's `.cursor-plugin/marketplace.json` as a custom marketplace source).
+2. When Cursor prompts you to configure the plugin, fill in:
+   - **Checkmarx One API Host** — e.g. `ast.checkmarx.net`
+   - **Tenant ID** — your Checkmarx tenant identifier
+   - **API Key** *(optional)* — leave blank to authenticate via browser-based OAuth2 login on first use instead
+3. Restart Cursor.
+
+That's it — Cursor reads the plugin's `mcp.json` and registers the `Checkmarx` MCP server for you using the values you entered.
+
+## Verify
+
+Ask Cursor:
+```
+What MCP servers are available?
+```
+or
+```
+List all Checkmarx tools
+```
+
+If you left the API Key blank, the first tool call will open a browser window for you to log in to Checkmarx One. After that, token refresh is handled automatically.
+
+## Updating configuration later
+
+Reopen the plugin's configuration panel in Cursor (Settings → Plugins → Checkmarx → Configure) to change your API host, tenant ID, or API key — no file editing required.
+
+## Troubleshooting
+
+**MCP not appearing in Cursor**
+- Confirm the plugin shows as installed and configured in Settings → Plugins.
+- Confirm Cursor was restarted after installing/configuring the plugin.
+
+**Connection error**
+- Double-check the API host (e.g. `ast.checkmarx.net`, no `https://` prefix) and tenant ID.
+- Confirm network access to your Checkmarx One tenant.
+
+**401 Unauthorized**
+- If using OAuth2 (API Key left blank), make sure you completed the browser login prompt.
+- If using an API key, verify it hasn't expired and that your Checkmarx user has the required permissions.
+
+See [docs/authentication.md](../../docs/authentication.md) for full authentication details.
+
+## Getting help
+
+Contact: support@checkmarx.com

plugins/cx-cursor-plugin/mcp.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "Checkmarx": {
+      "url": "https://${CXONE_BASE_URL}/api/security-mcp/mcp/${CXONE_TENANT_ID}"
+    }
+  }
+}

server.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "com.checkmarx/security-mcp",
+  "name": "com.checkmarx/checkmarx",
   "description": "Official Checkmarx MCP Server",
   "repository": {
     "url": "https://github.com/Checkmarx/cx-agentic-ai",
@@ -11,9 +11,9 @@
   "remotes": [
     {
       "type": "streamable-http",
-      "url": "https://{api_host}/api/security-mcp/mcp/{tenant_id}",
+      "url": "https://{cxone_base_url}/api/security-mcp/mcp/{tenant_id}",
       "variables": {
-        "api_host": {
+        "cxone_base_url": {
           "description": "API host provided by your Checkmarx administrator, e.g., ast.checkmarx.net",
           "isRequired": true
         },