MCP, MCP server
com.checkmarx/checkmarx
Official Checkmarx MCP Server
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 3da7e5c1ea77, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
hooks/cx_check.py, line 564
result = subprocess.run( - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 63
# Exported as http_proxy/https_proxy (both cases) so curl AND wget honor it natively - including HTTPS
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
hooks/cx_check.py, line 564
result = subprocess.run(
hooks/cx_check.py, line 600
result = subprocess.run(
hooks/cx_check.py, line 700
result = subprocess.run(_auth_validate_cmd(), stdout=subprocess.PIPE,
Show more
hooks/cx_check.py, line 1337
result = subprocess.run(
hooks/cx_check.py, line 1378
result = subprocess.run(
hooks/cx_log.py, line 265
os.remove(oldest)
plugins/codex-devassist/hooks/cx_check.py, line 372
result = subprocess.run(
plugins/codex-devassist/hooks/cx_check.py, line 408
result = subprocess.run(
plugins/codex-devassist/hooks/cx_check.py, line 508
result = subprocess.run(_auth_validate_cmd(), stdout=subprocess.PIPE,
plugins/codex-devassist/hooks/cx_log.py, line 255
os.remove(oldest)
plugins/copilot-devassist/hooks/cx_log.py, line 257
os.remove(oldest)
plugins/cursor-devassist/hooks/cx_log.py, line 225
os.remove(oldest)
plugins/cursor-devassist/scripts/cx-rules-install.py, line 81
os.remove(path)
plugins/cx-devassist/hooks/cx_log.py, line 229
os.remove(oldest)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 63
# Exported as http_proxy/https_proxy (both cases) so curl AND wget honor it natively - including HTTPS
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 131
if command -v curl &>/dev/null; then
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 132
curl -fsSL --retry 3 --retry-delay 2 --retry-connrefused "$url" -o "$archive" \
Show more
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 134
elif command -v wget &>/dev/null; then
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 135
wget -qO "$archive" "$url" || die "download failed (wget) from $url"
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 137
die "neither curl nor wget is available to download $url"
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 215
# releases/latest URL. Uses curl OR wget (so a no-curl machine still resolves); returns 1 otherwise.
plugins/codex-devassist/scripts/cx-bootstrap.sh, line 218
if command -v curl >/dev/null 2>&1; then
plugins/codex-devassist/skills/cx-cli-setup/references/manual-install.md, line 34
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_darwin_x64.tar.gz -o /tmp/cx-cli.tar.gz && \
plugins/codex-devassist/skills/cx-cli-setup/references/manual-install.md, line 53
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_linux_x64.tar.gz -o /tmp/cx-cli.tar.gz && \
plugins/codex-devassist/skills/cx-cli-setup/references/manual-install.md, line 76
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_windows_x64.zip -o /tmp/cx-cli.zip && \
plugins/copilot-devassist/skills/cx-cli-setup/references/manual-install.md, line 34
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_darwin_x64.tar.gz -o /tmp/cx-cli.tar.gz && \
plugins/copilot-devassist/skills/cx-cli-setup/references/manual-install.md, line 53
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_linux_x64.tar.gz -o /tmp/cx-cli.tar.gz && \
plugins/copilot-devassist/skills/cx-cli-setup/references/manual-install.md, line 76
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_windows_x64.zip -o /tmp/cx-cli.zip && \
plugins/cursor-devassist/skills/cx-cli-setup/references/manual-install.md, line 34
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_darwin_x64.tar.gz -o /tmp/cx-cli.tar.gz && \
plugins/cursor-devassist/skills/cx-cli-setup/references/manual-install.md, line 53
curl -fsSL https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_linux_x64.tar.gz -o /tmp/cx-cli.tar.gz && \
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 3da7e5c1ea77. can delete files. can reach a host that is not written as a fixed address.
Date and source
Date checked:
github.com
Commit graded: 3da7e5c1ea77d03171e4f66d6cfc13951de3d1dd
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.