Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/checkmarx/cx-agentic-ai/cx-devassist-scagit clone --depth 1 https://github.com/Checkmarx/cx-agentic-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/checkmarx/cx-agentic-ai/cx-devassist-sca)<a href="https://agentmods.dev/rules/checkmarx/cx-agentic-ai/cx-devassist-sca"><img src="https://agentmods.dev/badge/rules/checkmarx/cx-agentic-ai/cx-devassist-sca.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00784 |
| Opus 5 | $0.00000 | $0.00392 |
| Sonnet 5 | $0.00000 | $0.00157 |
| Haiku 4.5 | $0.00000 | $0.00078 |
Grade A, and why
cx-devassist-sca scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CX DevAssist SCA (OSS)
Use for dependency manifest/lockfile scan/fix. For source code SAST, use cx-devassist-asca instead.
Routing
| Target | Use |
|---|---|
| Source file | cx-devassist-asca |
| Manifest/lockfile | This rule / /cx-devassist-sca |
| Whole repo / cloud scans | Checkmarx MCP scan tools |
If SCA findings are already in context, skip scan — go straight to remediation.
Scan
# Unix:
"$HOME/.checkmarx/bin/cx" scan oss-realtime -s "<manifest-path>"
# Windows:
"$LOCALAPPDATA/Checkmarx/cx/cx.exe" scan oss-realtime -s "<manifest-path>"
Interpret Status: OK clean, Unknown unverified (not safe), Malicious remove, other → vulnerable.
Report findings and ask the user whether to remediate (upgrade/remove) or suppress (accept the risk) before proceeding.
Remediation (MCP-only)
For each finding, call mcp__plugin-cx-devassist-Checkmarx__packageRemediation — follow the tool's input schema (package manager, name, version, CVEs).
- MCP available → apply
remediation_steps; change only affected dependency entries - MCP unavailable → STOP. No manual version bumps. Run
/cx-cli-setupif auth fails; ask developer to Developer: Reload Window for MCP - No fixed version in the response → check the response for a suggested alternative package and apply that instead; never web-search or self-research a fix or alternative. If the response offers neither, suppress the finding and tell the user — see
skills/cx-devassist-sca/SKILL.mdStep 3.
After fixes, re-scan. Remediate only packages you changed; leave pre-existing findings unfixed.
Skill compliance (mandatory)
Invoke and follow skills/cx-devassist-sca/SKILL.md exactly as written — as-is, with no paraphrasing, summarizing, or reimplementing its steps inline in this rule or in chat. Do not skip, abbreviate, substitute your own judgment for, or reorder any step.
The Step 5 SCA Remediation Summary is mandatory output — always produce and show it to the user verbatim, in full, after remediation completes, even for a single finding. Never omit it, shorten it, or fold it into other output:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 64 lines · 0 tokens per session scan A 4a9aff10d0d4
cx-devassist-sca is a cursor rule published in the GitHub repository Checkmarx/cx-agentic-ai (0 stars, last pushed yesterday), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 784 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
cursorrules
When the user asks about quiz generator, use quiz-generator-ai-mcp tools: generatequiz, validateanswers, generateflashcards, assessdifficulty.
cursorrules
When the user asks about social media, use social-media-ai-mcp tools: schedulepost, generatehashtags, analyzeengagement, plancontentcalendar, getaudienceinsights.
cursorrules
When the user asks about web research, use web-research-mcp tools: websearch, browsepage, extractarticle, researchtopic, getweather.
cursorrules
When the user asks about lead scoring, use lead-scoring-ai-mcp tools: scorelead, addlead, updateleadactivity, getleadscore, getallleads.
cursorrules
When the user asks about ecommerce, use ecommerce-ai-mcp tools: writeproductdescription, optimizepricing, summarizereviews, forecastinventory, generateseometa.
cursorrules
When the user asks about invoice generator, use invoice-generator-ai-mcp tools: generateinvoice, calculatetotals, validateinvoice, listtemplates.