Checkmarx Developer Assist

Checkmarx Developer Assist is the developer-side member of the Checkmarx Agentic AI pillar. It plugs into VS Code, IntelliJ, Eclipse, and the GitHub or GitLab pull request, surfaces Checkmarx findings inside the file the developer is editing, and writes fix suggestions grounded in the customer's own scan results, codebase patterns, and historical triage decisions. The output is contextual to the actual application rather than the generic suggestions a free-floating coding LLM would produce.

The agent reads from the same Checkmarx One findings model that powers SAST, SCA, DAST, API Security, and the cloud-native scanners. When a developer touches a file with an open SAST finding, Developer Assist proposes the fix in line, points at the specific flow path that triggered the issue, and emits the correction as a diff the developer can accept, edit, or reject. On pull-request time, it leaves comments on the changed lines that map back to Checkmarx findings rather than restating what the static analyzer already said.

What separates Developer Assist from generic AppSec AI is the grounding. Vendors that fine-tune on public code without hooking into the customer's findings store give suggestions that look correct and frequently are not, because the model has no awareness of the internal crypto wrapper the customer mandates, the input gateway every request must traverse, or the logging fields that are forbidden from carrying PII. Developer Assist consumes those rules through CxQL custom-rule output and proposes fixes that respect them. Triage and Remediation, the security-side counterpart, learns from how the AppSec team triaged the last hundred similar findings and feeds that pattern back into the developer-side suggestions.

What undermines Developer Assist adoption is treating it as an autonomous coder. The agent is a fix proposer, not a fix applier. Programs that turn on auto-merge for AI-suggested fixes ship regressions; programs that treat it as a high-quality first draft for the developer to review ship faster with fewer false starts. Merito's engagement defines the workflow boundary, tunes the agent against CxQL rules and prior triage history, and writes the guardrails into the IDE configuration before broad rollout.

Merito has sat in front of programs adopting generic coding AI assistants and watched them write fixes that pass static analysis, fail the customer's internal crypto policy, and ship anyway. The reason is grounding. A coding LLM fine-tuned on public GitHub has no awareness of the internal crypto wrapper, the input gateway, or the logging field rules that AppSec encoded last quarter. It writes plausible code that is wrong for this codebase. Developer Assist works because it consumes the actual findings, the actual CxQL rules, and the actual triage history.

Merito recommends Developer Assist specifically when the AppSec program already has Checkmarx One running, CxQL custom rules are drafted or in progress, and the engineering org is willing to treat AI suggestions as a first draft rather than autonomous output. For programs without those preconditions, Developer Assist is still useful but the grounding advantage is muted. Merito surfaces that honestly during scoping rather than letting customers buy AI seats that will not differentiate from a free coding assistant.

The pairing with Triage and Remediation is the load-bearing move. Dev-side AI on its own gets stale; sec-side triage feeding back into the dev-side suggestions is what makes the agent improve over time. Programs licensing Developer Assist without Triage and Remediation are running half the loop. Merito recommends both or neither.