VS Code Extension

Explore the docs »
Marketplace »

Table of Contents

1. Overview
2. Checkmarx One Results
3. KICS Realtime Scanner
4. Checkmarx SCA Realtime Scanner
5. Initial Setup
6. Contributing
7. License
8. Feedback
9. Contact

Overview

Checkmarx continues to spearhead the shift-left approach to AppSec by bringing our powerful AppSec tools into your IDE. This empowers developers to identify vulnerabilities and remediate them as they code. The Checkmarx Visual Studio Code plugin integrates seamlessly into your IDE, identifying vulnerabilities in your proprietary code, open source dependencies, and IaC files. The plugin offers actionable remediation insights in real-time.

The Checkmarx Visual Studio Code extension contains three separate tools:

• Checkmarx One Results

• KICS Realtime Scanner

• Checkmarx SCA Realtime Scanner

The plugin is available on marketplace. In addition, the code can be accessed here.

Checkmarx One Results

This tool enables Checkmarx One users to access the full functionality of your Checkmarx One account directly from your IDE. You can run new scans or import results from scans run in your Checkmarx One account. Checkmarx provides detailed info about each vulnerability, including remediation recommendations and examples of effective remediation.

The extension enables you to navigate from a vulnerability to the relevant source code, so that you can easily zero-in on the problematic code and start working on remediation. This tool requires authentication, using credentials from your Checkmarx One account.

GIF - Running a Scan from the IDE

GIF - Loading and Viewing Results

Key Features

• Access the full power of Checkmarx One (SAST, SCA, IaC Security and Secret Detection) directly from your IDE.

• Run a new scan from your IDE even before committing the code, or import scan results from your Checkmarx One account.

• Rescan an existing branch from your IDE or create a new branch in Checkmarx One for the local branch in your workspace.

• Provides actionable results including remediation recommendations. Navigate from results panel directly to the highlighted vulnerable code in the editor and get right down to work on the remediation.

• View info about how to remediate SAST vulnerabilities, including code samples

• Group and filter results

• Triage results - edit the result predicate (severity, state and comments) directly from the Visual Studio Code console

• Links to Codebashing lessons

• Apply Auto Remediation to automatically remediate open source vulnerabilities, by updating to a non-vulnerable package version.

• "AI Guided Remediation" harnesses the power of AI to help you to understand the vulnerabilities in your code, and resolve them quickly and easily.

• AI Secure Coding Assistant (ASCA) - A lightweight scan engine that runs in the background while you work, enabling developers to identify and remediate secure coding best practice violations as they code.

Prerequisites

• An installation of VS Code version 1.63.0 or above

• You have an API Key for your Checkmarx One account. To create an API key, see Generating an API Key.

In order to use this integration for running an end-to-end flow of scanning a project and viewing results, the API Key must have at a minimum the out-of-the-box composite role ast-scanner as well as the IAM role default-roles.

• "git" is installed on your local machine. For installation instructions, see here.

• In order to use AI Generated Remediation, you need to have an API Key for your GPT account.

KICS Realtime Scanner

This tool initiates KICS scans directly from their VS Code console. The scan runs automatically whenever an infrastructure file of a supported type is saved, either manually or by auto-save. The scan runs only on the file that is open in the editor. The results are shown in the VS Code console, making it easy to remediate the vulnerabilities that are detected. This is a free tool provided by Checkmarx for all VS Code users, and does not require the user to submit credentials for a Checkmarx One account.

GIF - Automatic Remediation for KICS Vulnerabilities

Key Features

• Free tool, no Checkmarx account required

• Run scans directly from your IDE

• Scans are triggered automatically whenever a file is saved

• Apply Auto Remediation to automatically fix IaC vulnerabilities

• AI Guided Remediation”harnesses the power of AI to help you to understand the vulnerabilities in your code, and resolve them quickly and easily.

Prerequisites

• You must have a supported container engine (e.g., Docker, Podman etc.) installed and running in your environment.

• In order to use AI Generated Remediation, you need to have an API Key for your GPT account.

Checkmarx SCA Realtime Scanner

This tool enables VS Code users to initiate SCA scans directly from their VS Code console, and shows detailed results as soon as the scan is completed. The scan identifies the open-source dependencies used in your code and indicates the security risks associated with those packages. The identified packages are shown in a tree structure with an indication of the risk level for each package. You can drill down to show the specific vulnerabilities associated with a package. This is a free tool provided by Checkmarx for all VS Code users, and does not require the user to submit credentials for a Checkmarx One account.

Key Features

• Free tool, no Checkmarx account required

• Run scans directly from your IDE

• View actionable results in your IDE, indicating which of your open-source packages are at risk

• Provides links to detailed info about the vulnerabilities on the Checkmarx Developer Hub

Prerequisites

• In order to get comprehensive results, you need to install all relevant package managers on your local environment, see Installing Supported Package Managers.

Initial Setup

1. Verify that all prerequisites are in place.

2. Install the extension from Marketplace.

3. Configure the extension settings as follows:

• For KICS Realtime Scanner and SCA Realtime Scanner - no configuration needed.

• For SCA Realtime Scanning, if your environment doesn't have access to the internet, then you will need to configure a proxy server in the Settings, under Checkmarx One: Additional Params.

• For Checkmarx One Results - use your Checkmarx One API Key to integrate with your Checkmarx One account, as described here.

• If you would like to use AI Guided Remediation, use your GPT API Key to integrate with your GPT account, as described here.

GIF - Installing and Setting up the Extension

Contributing

We appreciate feedback and contribution to the VsCode extension! Before you get started, please see the following:

• Checkmarx contribution guidelines
• Checkmarx Code of Conduct

License

Distributed under the Apache 2.0. See LICENSE for more information.

Feedback

We’d love to hear your feedback! If you come across a bug or have a feature request, please let us know by submitting an issue in GitHub Issues.

Contact

Checkmarx - Integrations Team

Project Link: https://github.com/Checkmarx/ast-vscode-extension

Find more integrations from our team here

© 2024 Checkmarx Ltd. All Rights Reserved.