cx-devassist-kics

CX DevAssist KICS (IaC)

Use for Infrastructure-as-Code misconfiguration scan/fix (Dockerfile, Terraform, Kubernetes YAML, etc.). For source code SAST use cx-devassist-asca; for dependency manifests use cx-devassist-sca.

Routing

Target	Use
IaC file (Dockerfile, .tf, .yaml, …)	This rule / cx-devassist-kics
Source code file (.py, .js, .java, …)	cx-devassist-asca
Manifest/lockfile (package.json, go.mod, …)	cx-devassist-sca
Whole repo / cloud scans	Checkmarx MCP scan tools

If KICS findings are already in context (hook deny agent_message, CHECKMARX_HOOK_DENY block), skip scan — go straight to remediation. Never retry a blocked Write/StrReplace or paste blocked code in chat.

Scan

# Unix:
"$HOME/.checkmarx/bin/cx" scan iac-realtime -s "<file-path>"
# Windows:
"$LOCALAPPDATA/Checkmarx/cx/cx.exe" scan iac-realtime -s "<file-path>"

Report findings (title, severity, line, description). KICS findings are deterministic IaC rule matches — they are never false positives caused by missing cross-file context. Fix every finding; do not suppress or dismiss any as a false positive.

Remediation (MCP-only)

For each finding, call mcp__plugin-cx-devassist-Checkmarx__imageRemediation with:

{
  "type": "iac",
  "metadata": {
    "title": "[Title from finding]",
    "description": "[Description from finding]",
    "remediationAdvice": "[how to harden this configuration]"
  }
}

• MCP available → apply remediation_steps in order; change only code at/near the flagged line
• MCP unavailable → STOP. No manual fixes. Run /cx-cli-setup if auth fails; ask developer to Developer: Reload Window for MCP

After fixes, re-scan. Remediate only in-scope findings (your changes or the original target); leave pre-existing findings unfixed.

If a fix genuinely requires resources outside this file (e.g. a separate KMS key or a centrally-managed policy), add them as part of your change rather than skipping the finding.