checkmarx-cli-setup

Installs, upgrades, and authenticates the Checkmarx cx CLI for security scanning.

2|Updated Jun 10, 2026
One-click install
npx skills add https://github.com/Checkmarx/cx-agentic-ai --skill checkmarx-cli-setup-checkmarx
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: checkmarx-cli-setup
Source: https://github.com/Checkmarx/cx-agentic-ai/tree/main/plugins/copilot-devassist/skills/checkmarx-cli-setup
Command: npx skills add https://github.com/Checkmarx/cx-agentic-ai --skill checkmarx-cli-setup-checkmarx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? The Checkmarx security plugin cannot scan code until the cx CLI is installed, at a supported version, and authenticated — and a missing or misconfigured CLI leaves every gated action blocked. This Skill walks the developer through the full setup so the security gate clears and scanning can begin. ## Core Features & Use Cases - Guided installation: Runs the bundled cx-bootstrap.sh installer with checksum verification, or falls back to per-OS manual install steps for macOS, Linux, and Windows. - Two authentication paths: Configures the CLI via API key or browser-based OAuth sign-in with MFA, including re-authentication when credentials expire. - Verification and troubleshooting: Validates connectivity with cx auth validate, enforces a minimum CLI version, and resolves PATH, self-hosted URI, and gate-still-denied issues. - Use Case: A hook blocks a file write because cx is not authenticated. Invoke this Skill to assess the current state, install or upgrade the CLI, sign in, and confirm the gate clears on the next tool call. ## Quick Start Ask the assistant to set up and authenticate the Checkmarx cx CLI so the security plugin can start scanning.

Frequently Asked Questions about checkmarx-cli-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I install the Checkmarx cx CLI?

Run the bundled cx-bootstrap.sh script, which downloads the correct release asset for your OS and architecture, verifies its checksum, and installs cx to the canonical store (~/.checkmarx/bin/cx on Unix, %LOCALAPPDATA%\Checkmarx\cx\cx.exe on Windows). Manual per-OS install steps are available if bash is unavailable.

How do I authenticate the Checkmarx CLI with an API key?

Create a key in the Checkmarx One portal under Settings → Identity and Access Management → API Keys, then run cx configure set --prop-name cx_apikey --prop-value <key>. The CLI extracts the server URL and tenant from the key automatically.

Does the cx CLI support browser-based OAuth login?

Yes, builds that list login under cx auth --help support cx auth login --base-auth-uri <URL> --tenant <tenant>, which opens a browser for MFA sign-in and saves a refresh token. Older builds only support API key authentication.

Why is cx command not found right after installation?

A running agent session froze its PATH at startup, so a bare cx returns 127 even though the install succeeded. The security gate resolves cx by absolute path from the canonical store, so it clears on the next tool call without a restart.

What happens if my cx CLI version is below the minimum required?

The gate hard-blocks every action, including cx auth login, until you upgrade. Run the bootstrap script in upgrade mode, then run /restart so the remediation MCP re-spawns against the new binary.

How do I fix expired Checkmarx credentials?

Re-authenticate without reinstalling: generate a new API key and re-run the cx configure set command, or re-run cx auth login with the same URL and tenant flags. The remediation MCP picks up the rotated credential automatically.