checkmarx.com
Checkmarx provides application security products for scanning source code, open source dependencies, infrastructure as code, secrets, APIs, and related software risk. Its Checkmarx One platform centralizes these AppSec capabilities for enterprise development and security workflows.
Checkmarx exposes documented REST APIs for Checkmarx One and SCA, a Checkmarx One CLI, and markets an MCP server; developer auth is via Checkmarx-issued API keys or OAuth clients, while MCP connection details were not publicly documented.
- Checkmarx MCP Serverdiscovered
- Checkmarx One REST APIdiscovered
- Checkmarx SCA REST APIdiscovered
- Checkmarx One CLIdiscovered
In the Checkmarx One web portal, go to Creating an API Key for Checkmarx One Integrations. Sign in, open Settings → API Keys (or Identity and Access Management in older docs), click Create Key, and copy the generated key. The CLI docs describe this API key as a refresh-token style credential that can be used for CLI and plugin authentication.
Create an OAuth client in Checkmarx One using Creating OAuth Clients. Sign in to Checkmarx One, open Settings → Identity and Access Management, create a client, and save the client credentials. Authentication for Checkmarx One CLI and Plugins says OAuth clients can be used instead of API keys and let you scope permissions more precisely.
conventions · 1/7 published
- integrations.json——
- llms.txt✓https://checkmarx.com/llms.txt
- API catalog✗
/.well-known/api-catalog - OpenAPI document✗
/api/schema/, /openapi.json, /swagger.json, /api/openapi.json, or /v1/openapi.json - MCP server card✗
/.well-known/mcp/server-card.json - OAuth protected resource✗
/.well-known/oauth-protected-resource - Agent card✗
/.well-known/agent-card.json - Agent skills✗
/.well-known/agent-skills/index.json
Publish these signals → /publishing