Checkmarx CxSCA Integration Guide

Integrate Checkmarx SCA with Vulnetix. Use the Checkmarx One CLI (cx) to scan dependencies and export results as SARIF or CycloneDX for upload to Vulnetix.

Run Checkmarx CxSCA in CI

Scan on every push and upload the report as a workflow artifact:

- name: Checkmarx One SCA Scan
  uses: checkmarx-ts/checkmarx-one-github-action@v1
  with:
    base-uri: ${{ secrets.CX_BASE_URI }}
    client-id: ${{ secrets.CX_CLIENT_ID }}
    client-secret: ${{ secrets.CX_CLIENT_SECRET }}
    scan-types: 'sca'
    output-format: 'sarif'

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: checkmarx-sca
    path: results/cx_result.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Checkmarx CxSCA's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Checkmarx CxSCA. Keep running it. Vulnetix sits on top of Checkmarx CxSCA (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Checkmarx CxSCA is strongest at its core category and also carries features in SBOM Generation, License Compliance, Container & Image Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Checkmarx CxSCA does well

• Exploitable-path reachability: runs SAST on your first-party code in parallel with the manifest to confirm whether a vulnerable library method is actually called, cutting noise to genuinely reachable issues
• Deep integration inside the unified Checkmarx One platform (SAST, DAST, IaC, API security, ASPM) so SCA findings share correlation and one console
• Governed Triage Assist / Remediation Assist that turns findings into review-ready, prioritised remediation pull requests
• Mature enterprise SBOM lifecycle: generate, ingest, share and manage CycloneDX/SPDX with VEX triage exported into SBOMs and reports

Where Vulnetix adds to it: Both do reachability, EPSS/KEV, VEX and fix PRs, but Checkmarx keeps them inside its own platform. Vulnetix is scanner-agnostic: it ingests Checkmarx SCA output (SARIF/CycloneDX) alongside every other scanner, dedups across all of them into one prioritised queue, and layers Vulnetix LEV/Coalition ESS/SSVC/EOL and Safe Harbour autofix on top, and better together rather than a replacement for Checkmarx's core SCA engine.

No migration, no rip-and-replace. Checkmarx CxSCA keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Checkmarx CxSCA results in Vulnetix

Upload Checkmarx CxSCA SARIF, CycloneDX, SPDX, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Checkmarx CxSCA documentation ↗

Wire Checkmarx CxSCA into your CI/CD pipeline →