cx-cli-setup

CX CLI Setup

Guides the developer through installing, upgrading, and authenticating the Checkmarx One cx CLI so the security plugin can operate. The OS is known from the Cursor session — use the matching path; no detection command is needed. Detailed steps live under references/ (see Additional Resources); this router is the spine.

When to Use

• The cx CLI is not installed or not found in PATH
• A hook blocked a scannable file write because cx is missing or below the minimum version
• The developer explicitly runs /cx-cli-setup to reconfigure or reauthenticate
• The plugin detected expired credentials and needs a re-auth step

Phase 0 — Assess Current State

Run both checks to decide where to enter. Run them as two separate commands, one at a time — never chained with ||/&&/;: the security gate only lets a bare, unchained command through this early (before cx is installed/authenticated), so a chained probe is itself blocked and never reaches cx at all. The OS is already known from the Cursor session, so run only the matching Check 1 — do not try both:

# Check 1 — is the CLI present? (bare command, no chaining/redirect)
which cx          # bash / sh (macOS, Linux, Git Bash)
where cx          # cmd.exe
Get-Command cx    # PowerShell

# Check 2 — only if present (identical in every shell)
cx auth validate

Shell syntax matters from here on. Cursor's Shell tool runs the workspace's default shell — PowerShell on Windows, bash/zsh on macOS/Linux, cmd.exe where configured — and they disagree about invoking a quoted path, discarding stdout, and referencing environment variables. Every per-shell form used below is spelled out once in references/shells.md; read it before writing a command that names an absolute path or a redirect.

CLI present	Auth result	Action
No	—	Offer the custom-path option (references/troubleshooting.md), then go to Phase 1
Yes	Success	Tell the developer all looks good; ask if they want to reconfigure/reauth anyway. If no, exit.
Yes	Credential failure (invalid/revoked/expired)	CLI is installed but auth failed — skip to Phase 2.
Yes	Network failure (DNS/refused/timeout)	CLI is installed but the server is unreachable — do not go to Phase 2; have them check network/proxy, then re-run cx auth validate.