Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/checkmarx/cx-agentic-ai/cx-devassist-ascagit clone --depth 1 https://github.com/Checkmarx/cx-agentic-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/checkmarx/cx-agentic-ai/cx-devassist-asca)<a href="https://agentmods.dev/rules/checkmarx/cx-agentic-ai/cx-devassist-asca"><img src="https://agentmods.dev/badge/rules/checkmarx/cx-agentic-ai/cx-devassist-asca.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00737 |
| Opus 5 | $0.00000 | $0.00368 |
| Sonnet 5 | $0.00000 | $0.00147 |
| Haiku 4.5 | $0.00000 | $0.00074 |
Grade A, and why
cx-devassist-asca scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CX DevAssist ASCA (SAST)
Use for source code vulnerability scan/fix. For dependency manifests/lockfiles, use cx-devassist-sca instead.
Routing
| Target | Use |
|---|---|
| Source file (.py, .js, .java, …) | This rule / /cx-devassist-asca |
| Manifest/lockfile (package.json, go.mod, …) | cx-devassist-sca |
| Whole repo / cloud scans | Checkmarx MCP scan tools |
If findings are already in context (hook deny agent_message, CHECKMARX_HOOK_DENY block, prior scan, stop-hook followup_message), skip scan — go straight to remediation. Never retry a blocked Write/StrReplace or paste blocked code in chat.
Scan
# Unix:
"$HOME/.checkmarx/bin/cx" scan asca -s "<file-path>"
# Windows:
"$LOCALAPPDATA/Checkmarx/cx/cx.exe" scan asca -s "<file-path>"
Report findings (rule_name, severity, line, description). Ask the user whether to remediate (fix) or suppress (false positive) each finding before proceeding.
Remediation (MCP-only)
For each finding, call mcp__plugin-cx-devassist-Checkmarx__codeRemediation with type: "sast" and metadata from the scan.
- MCP available → apply
remediation_stepsin order; change only code at/near the problematic line - MCP unavailable → STOP. No manual fixes. Run
/cx-cli-setupif auth fails; ask developer to Developer: Reload Window for MCP
After fixes, re-scan. Remediate only in-scope findings (your changes or the original target); leave pre-existing findings unfixed.
Skill compliance (mandatory)
Invoke and follow skills/cx-devassist-asca/SKILL.md exactly as written — as-is, with no paraphrasing, summarizing, or reimplementing its steps inline in this rule or in chat. Do not skip, abbreviate, substitute your own judgment for, or reorder any step.
The Step 5 Remediation Summary is mandatory output — always produce and show it to the user verbatim, in full, after remediation completes, even for a single finding. Never omit it, shorten it, or fold it into other output:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 65 lines · 0 tokens per session scan A c7694016f928
cx-devassist-asca is a cursor rule published in the GitHub repository Checkmarx/cx-agentic-ai (0 stars, last pushed yesterday), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 737 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
cursorrules
When the user asks about quiz generator, use quiz-generator-ai-mcp tools: generatequiz, validateanswers, generateflashcards, assessdifficulty.
cursorrules
When the user asks about social media, use social-media-ai-mcp tools: schedulepost, generatehashtags, analyzeengagement, plancontentcalendar, getaudienceinsights.
cursorrules
When the user asks about web research, use web-research-mcp tools: websearch, browsepage, extractarticle, researchtopic, getweather.
cursorrules
When the user asks about lead scoring, use lead-scoring-ai-mcp tools: scorelead, addlead, updateleadactivity, getleadscore, getallleads.
cursorrules
When the user asks about ecommerce, use ecommerce-ai-mcp tools: writeproductdescription, optimizepricing, summarizereviews, forecastinventory, generateseometa.
cursorrules
When the user asks about invoice generator, use invoice-generator-ai-mcp tools: generateinvoice, calculatetotals, validateinvoice, listtemplates.