Findings-to-Fix

Built on Checkmarx One Triage Assist and Remediation Assist, working inside VS Code through GitHub Copilot. Triage Assist has already evaluated the findings on the platform using Attackability-based context (reachability, exploitability, code context, policy signals) and confirmed the ones that require action. The plugin takes only those confirmed findings, asks Remediation Assist to generate the review-ready fix, and shows you each change to Keep or Undo. The agent proposes; you approve.

You ask Copilot to fix your findings. It pulls only the findings Triage Assist has confirmed, asks Remediation Assist for the fix, and shows you the change. That is the whole thing.

Using Claude Code instead? Use cx-findings-to-fix-claude, the Claude Code version of this same plugin.

Getting started

You need three things once. After that it is just asking Copilot.

1. Python or Node on your machine

Either one works, and the plugin picks whichever it finds. Most Macs and Linux machines already have Python 3. On Windows, note that a fresh machine has a python3 that is only a Microsoft Store shortcut, not Python; the plugin detects that and uses Node instead, so having Node installed is enough.

2. Install the plugin in VS Code

Open VS Code (1.104 or newer) with the GitHub Copilot Chat extension.
Press Cmd+Shift+P (Mac) or Ctrl+Shift+P (Windows), type Chat: Install Plugin From Source, press Enter.
Paste this repository's Git URL and press Enter.
Reload the window when VS Code asks.

You will see a short "Findings-to-Fix" note when a chat session starts.

3. Authenticate once

Ask your Checkmarx admin for an API key (Checkmarx One > Settings > Identity and Access Management > API Keys). Then run the plugin's one-line auth command in a terminal. When you are not authenticated yet, the "Findings-to-Fix" note at the start of a chat session shows you the exact command, in the form:

python3 "<the plugin's ftf.py>" auth

Paste the key when prompted (the input is hidden). The key is verified against your tenant on the spot and stored securely on your machine; every later run finds it automatically. Nothing is typed into the chat, and no environment variables are needed. For CI or headless use, setting CX_APIKEY also works.

Using it

Open the project you want to fix in VS Code.
Open Copilot Chat. In the agents dropdown at the bottom of the chat box, pick Findings-to-Fix. (If you forget, asking the default agent to "fix my confirmed Checkmarx findings" also works.)
Type: fix my confirmed findings

Copilot will:

work out which Checkmarx project and scan this is. If the project name does not match your git setup, it lists the likely projects and asks you to pick. If only one branch has scans (common for monorepos and zip uploads, where Checkmarx files scans under the branch name .unknown), it uses that and tells you. If several branches have scans and yours is not one of them, it lists them with dates and asks. It never guesses.
fetch the fixes from Checkmarx (a couple of minutes the first time, seconds after that).
show you a table of the confirmed findings and ask which to apply.
open each changed file in your editor with the change shown as a diff. Click Keep or Undo on each one.
explain what each fix does and why.
offer to run the tests Checkmarx generated for the fix.

Nothing is committed or pushed. You review, then commit as usual.

What you will see

You:      fix my confirmed findings
Copilot:  Project CxRW-Sandbox/ProjectHub9, branch feat/update-routes,
          scan from 2026-08-13. 1 confirmed critical/high finding.
          | # | Severity | Finding    | Location            | Files touched                     |
          | 0 | CRITICAL | Stored_XSS | backend/app.py:137  | jinja_filters.py, test_utils.py   |
          Apply all?
You:      yes
Copilot:  [two files open in the editor with the changes shown; Keep / Undo on each]
          backend/utils/jinja_filters.py   +4/-1   escape user text before rendering
          backend/tests/test_utils.py     +147/-0  tests for the fix
          What: ... Why: ... How: ...
          Checkmarx generated tests in backend/tests/test_utils.py. Run them?

Good to know

Only findings that Checkmarx Triage Assist has marked Confirmed, at critical or high severity, are fixed. Nothing else is touched.
Generating a fix runs Checkmarx Remediation Assist and consumes Checkmarx Credits. The plugin never generates one without asking: it tells you how many findings already have a fix (free to fetch) and how many would need generating, and waits for your yes. Copilot says so before anything is spent.
If you edited a file near the vulnerable code since the last scan, Copilot places the fix into your current code by hand instead of applying it blindly, and tells you so. Your edits stay.
It works whether your project folder is a git clone or a plain folder.
The tool keeps its working files in a .ftf folder at the project root. It holds the fetched fix data, so add it to .gitignore or delete it when you are done; it does not belong in a commit.
Monorepos: if you open one service's folder rather than the whole repo, you see only the findings under that folder, and it tells you how many the project has in total. Ask for "all findings" to see everything.
Package (SCA) fixes are supported but off by default. Ask Copilot to "include package fixes" if you want them.
If something is missing (no API key, expired key, feature not enabled on your tenant), Copilot tells you exactly what and how to fix it.

For admins: rolling it out to a team

Put this repository somewhere your developers can reach (Bitbucket, GitHub, an internal Git server). Then either

each developer installs it once with Chat: Install Plugin From Source and the repository URL, or
with Copilot Business or Enterprise, add the repository to managed-settings.json under extraKnownMarketplaces and list the plugin under enabledPlugins, and it installs for everyone automatically.

Copilot's terminal tool must be allowed by your organisation's Copilot policy; that is how the plugin runs.

What is in this repository

Each file has exactly one job.

cx-findings-to-fix/
├── plugin.json                    ← "this is a plugin": name, version, description
├── agents/findings-to-fix.agent.md← the Findings-to-Fix entry in the agents dropdown
│                                     and its protocol
├── skills/fix-confirmed-findings/
│   ├── SKILL.md                   ← the same protocol for the default agent
│   ├── ftf.py                     ← the tool: all the deterministic work
│   └── ftf.js                     ← the identical tool, for machines without Python
├── hooks/
│   ├── hooks.json                 ← "run check-auth.sh when a session starts"
│   └── check-auth.sh              ← tells Copilot where the tool is (and records it in
│                                     ~/.config/findings-to-fix/ftf-path); warns if no
│                                     API key is set
├── com.github.copilot/            ← the same agent and hooks in the Agent Plugins 1.0
│                                     namespace; current VS Code builds read the agents
│                                     dropdown entry from here, older builds from the
│                                     top-level folders (keep both copies identical)
└── docs/                          ← the guide (PDF), how-it-works, architecture page,
                                      screenshots

The split that matters: markdown decides, code does. The agent and the skill are the same protocol written for two entry points, and they hold all the judgment (ask rather than guess, propose rather than write, offer the tests once). The tool holds none: it talks to Checkmarx One, computes fixes against your files, and prints JSON. That line is why a run costs cents and behaves the same every time.

Nothing runs on a server. Nothing is installed besides this folder.

Support

Questions and issues: open an issue in this repository.