Can AI agents automate Checkmarx One?

Checkmarx One is automatable today through the Checkmarx One REST APIs. This record is the Checkmarx One platform for SAST, SCA, IaC Security, and Secrets Detection, including the vendor-hosted Checkmarx MCP. It is not Snyk, Semgrep, or Black Duck Signal. Checkmarx MCP is not a standalone product; vendor docs require an active Checkmarx One tenant. REST calls use Authorization: Bearer after exchanging an API Key or an OAuth client for an access token. Documented REST flows include POST /api/uploads, zip upload, POST /api/scans, GET /api/scans/{scanId}, and GET /api/results. Vendor docs state REST APIs cover project and application CRUD, scans, results, vulnerability management, and webhook creation. Container Security results are called out as GraphQL on a separate article that was not used for kinds. The official cx CLI wraps those REST tasks, installs on Windows, Linux, and macOS (and as checkmarx/ast-cli), and authenticates with interactive login, API Key, or OAuth client credentials. `cx results show` writes JSON by default and can emit SARIF. The hosted MCP is at {CX_BASE_URL}/api/security-mcp/mcp, with OAuth tenant URLs under /mcp/{tenant_name}. MCP auth is API Key, predefined client cx-mcp-client, or Dynamic Client Registration. Documented MCP tools cover scan workflow, findings, projects, applications, and licensed remediation. Vendor limits: initial-phase tools, no triage state changes, scanners limited to SAST/SCA/IaC/Secrets, local directory scanning needs the CLI, and remediation tools need Assist / AI Protection / Developer Assist. Outbound tenant webhooks exist for completed, failed, and partial scans and project created. iPaaS catalogs were not opened. Computer-use viability is unassessed. API and CLI both score 8. API is the best path because it is the native contract the CLI wraps and the MCP translates, with no extra binary for remote tenant automation.

Best path today: api · Overall automatability: 8/10