{
 "categories": [
  "developer-tools",
  "quality-management"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-06",
   "fact": "homepage",
   "note": "Checkmarx presents Checkmarx One as the unified application-security platform, listing SAST, Secrets Detection, IaC Security, SCA, and a Checkmarx MCP Server among platform capabilities.",
   "source": "https://checkmarx.com/product/application-security-platform/",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "license",
   "note": "The product page is a commercial platform with demo and sales paths. No public free self-serve plan was published on the opened page.",
   "source": "https://checkmarx.com/product/application-security-platform/",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "platforms",
   "note": "The official CLI installs on Windows, Linux, and macOS, with a checkmarx/ast-cli container image. The Checkmarx One portal is a web application.",
   "source": "https://docs.checkmarx.com/en/34965-68622-checkmarx-one-cli-installation.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.api.exists",
   "note": "Checkmarx documents REST APIs for project and application CRUD, running scans, viewing results, managing vulnerabilities, and creating webhooks.",
   "source": "https://docs.checkmarx.com/en/34965-68772-checkmarx-one-api-documentation.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.api.kinds[0]",
   "note": "POST /api/uploads on https://ast.checkmarx.net is documented as HTTPS JSON REST. The success body is a JSON object with an upload url. Authorization is Bearer.",
   "source": "https://docs.checkmarx.com/en/162175-162179-checkmarx-one-api---generate-upload-link.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.api.auth[0]",
   "note": "Checkmarx documents API Keys for authentication with API calls, the CLI, and plugins. Show details provides a curl to exchange the key for an access token. Keys inherit the generating user's roles and become invalid when the Checkmarx One license is updated.",
   "source": "https://docs.checkmarx.com/en/34965-188712-creating-api-keys.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.api.auth[1]",
   "note": "Checkmarx documents OAuth clients (client ID and client secret) that authorize API calls. Tokens can be limited by groups and Checkmarx One / IAM role mapping.",
   "source": "https://docs.checkmarx.com/en/34965-68612-creating-oauth-clients.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.api.coverage",
   "note": "REST is documented for projects, applications, scans, results, vulnerabilities, and webhooks. The same page says Container Security results use GraphQL on a separate article, so this record does not treat REST as every Checkmarx One surface.",
   "source": "https://docs.checkmarx.com/en/34965-68772-checkmarx-one-api-documentation.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.mcp.first_party",
   "note": "Checkmarx documents a hosted MCP server that connects Checkmarx One to MCP-compatible AI tools. FAQ text on the page states it is part of Checkmarx One, requires a tenant, and is not a standalone product. Auth is described as OAuth SSO with RBAC and tenant isolation.",
   "source": "https://checkmarx.com/solutions/checkmarx-mcp/",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.mcp.first_party",
   "note": "Vendor docs describe the MCP as a translation layer over Checkmarx One REST APIs. The HTTP URL is {CX_BASE_URL}/api/security-mcp/mcp, with OAuth tenant URLs under /mcp/{tenant_name}. Auth methods are API Key, predefined clientId cx-mcp-client, and Dynamic Client Registration.",
   "source": "https://docs.checkmarx.com/en/34965-659697-checkmarx-mcp-server---interacting-with-checkmarx-one-via-ai-assistants-and-integrations.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.cli.exists",
   "note": "The Checkmarx One CLI is documented as a wrapper that performs the REST API tasks: create/get/set/delete projects and scans, and get results. Quick start uses cx configure, project create, scan create, and results show.",
   "source": "https://docs.checkmarx.com/en/34965-68621-checkmarx-one-cli-quick-start-guide.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.extensibility.webhooks",
   "note": "Tenant-level webhooks POST scan events to an external payload URL. Events are Completed Scan, Failed Scan, Partial Scan, and Project Created. An optional secret and SSL verification are documented.",
   "source": "https://docs.checkmarx.com/en/34965-378162-tenant-level-webhooks.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.data_access.export[0]",
   "note": "cx results show defaults to JSON and writes cx_result.json.",
   "source": "https://docs.checkmarx.com/en/34965-68640-results.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.data_access.export[1]",
   "note": "cx results show --report-format sarif writes a SARIF report file.",
   "source": "https://docs.checkmarx.com/en/34965-68640-results.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened https://checkmarx.com/llms.txt. It is a markdown documentation index of Checkmarx One product pages, not an HTML fallback.",
   "source": "https://checkmarx.com/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "verdict.scores.api",
   "note": "The scan workflow is documented end to end over REST with Bearer tokens: generate upload link, upload zip, create scan, poll status, and GET /api/results. That is a broad, maintained production API. GraphQL for Container Security and license-gated scanners keep it below a 9\u201310.",
   "source": "https://docs.checkmarx.com/en/34965-68781-checkmarx-one-api---upload-source.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "verdict.scores.mcp",
   "note": "Hosted official MCP with a published tool table for scans, findings, projects, and applications. Vendor limits are initial-phase coverage, no triage, CLI required for local directory scans, DCR cap of 500 clients, and extra licenses for remediation tools.",
   "source": "https://docs.checkmarx.com/en/34965-659697-checkmarx-mcp-server---interacting-with-checkmarx-one-via-ai-assistants-and-integrations.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "verdict.scores.cli",
   "note": "The official CLI supports interactive browser login, API Key, and OAuth client credentials, with env, config file, and flag precedence. Combined with scan create and structured results export, that is a broad production CLI.",
   "source": "https://docs.checkmarx.com/en/34965-118315-authentication-for-checkmarx-one-cli.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "freshness.watch[0].url",
   "note": "Opened the current Checkmarx MCP docs. The older URL with -1-mcp-server---interacting-with-checkmarx-one-via-ai-assistant.html returned HTTP 500 on this pass.",
   "source": "https://docs.checkmarx.com/en/34965-659697-checkmarx-mcp-server---interacting-with-checkmarx-one-via-ai-assistants-and-integrations.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "freshness.watch[1].url",
   "note": "Opened the Checkmarx MCP product page. It lists SAST, SCA, IaC, and Secrets Detection through one MCP connection and names Claude Code, Windsurf, and other MCP clients.",
   "source": "https://checkmarx.com/solutions/checkmarx-mcp/",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current Checkmarx One API documentation overview, including the REST scope statement and the GraphQL note for Container Security.",
   "source": "https://docs.checkmarx.com/en/34965-68772-checkmarx-one-api-documentation.html",
   "tier": "declared"
  },
  {
   "date": "2026-09-06",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current Checkmarx One CLI quick start, including API Key configure, scan create, and results show.",
   "source": "https://docs.checkmarx.com/en/34965-68621-checkmarx-one-cli-quick-start-guide.html",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-06",
  "volatility": "high",
  "watch": [
   {
    "type": "mcp",
    "url": "https://docs.checkmarx.com/en/34965-659697-checkmarx-mcp-server---interacting-with-checkmarx-one-via-ai-assistants-and-integrations.html"
   },
   {
    "type": "mcp",
    "url": "https://checkmarx.com/solutions/checkmarx-mcp/"
   },
   {
    "type": "docs",
    "url": "https://docs.checkmarx.com/en/34965-68772-checkmarx-one-api-documentation.html"
   },
   {
    "type": "docs",
    "url": "https://docs.checkmarx.com/en/34965-68621-checkmarx-one-cli-quick-start-guide.html"
   }
  ]
 },
 "homepage": "https://checkmarx.com/product/application-security-platform/",
 "id": "checkmarx-one",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "api-key",
    "oauth-client"
   ],
   "coverage": "partial",
   "docs": "https://docs.checkmarx.com/en/34965-68772-checkmarx-one-api-documentation.html",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json",
    "sarif"
   ],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Checkmarx One's REST APIs, official cx CLI, outbound webhooks, and hosted first-party MCP cover scan and findings automation without browser control.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Checkmarx One",
 "platforms": [
  "web",
  "windows",
  "macos",
  "linux"
 ],
 "related": {
  "alternatives": [
   "snyk",
   "semgrep"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Checkmarx",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": 8,
   "computer_use": null,
   "integrations": null,
   "mcp": 7,
   "overall": 8,
   "rpa": null
  },
  "summary": "Checkmarx One is automatable today through the Checkmarx One REST APIs. This record is the Checkmarx One platform for SAST, SCA, IaC Security, and Secrets Detection, including the vendor-hosted Checkmarx MCP. It is not Snyk, Semgrep, or Black Duck Signal. Checkmarx MCP is not a standalone product; vendor docs require an active Checkmarx One tenant. REST calls use Authorization: Bearer after exchanging an API Key or an OAuth client for an access token. Documented REST flows include POST /api/uploads, zip upload, POST /api/scans, GET /api/scans/{scanId}, and GET /api/results. Vendor docs state REST APIs cover project and application CRUD, scans, results, vulnerability management, and webhook creation. Container Security results are called out as GraphQL on a separate article that was not used for kinds. The official cx CLI wraps those REST tasks, installs on Windows, Linux, and macOS (and as checkmarx/ast-cli), and authenticates with interactive login, API Key, or OAuth client credentials. `cx results show` writes JSON by default and can emit SARIF. The hosted MCP is at {CX_BASE_URL}/api/security-mcp/mcp, with OAuth tenant URLs under /mcp/{tenant_name}. MCP auth is API Key, predefined client cx-mcp-client, or Dynamic Client Registration. Documented MCP tools cover scan workflow, findings, projects, applications, and licensed remediation. Vendor limits: initial-phase tools, no triage state changes, scanners limited to SAST/SCA/IaC/Secrets, local directory scanning needs the CLI, and remediation tools need Assist / AI Protection / Developer Assist. Outbound tenant webhooks exist for completed, failed, and partial scans and project created. iPaaS catalogs were not opened. Computer-use viability is unassessed. API and CLI both score 8. API is the best path because it is the native contract the CLI wraps and the MCP translates, with no extra binary for remote tenant automation.\n"
 }
}