Run a Terraform scan against a directory: checkov -d ./infra --framework terraform -o sarif --output-file-path results.sarif.
Run a Kubernetes manifest scan: checkov -d ./k8s --framework kubernetes -o sarif --output-file-path k8s-results.sarif.
Upload the SARIF file to GitHub code scanning via the github/codeql-action/upload-sarif Action in your CI workflow to surface findings in the Security tab.
Suppress known-acceptable findings by adding a skip annotation comment (# checkov:skip=CHECK_ID:reason) directly above the relevant resource block in IaC files.
Integrate into CI by running checkov as part of a pull-request check and failing the pipeline when the exit code is non-zero (findings present).
Known gotchas
Checkov requires Python 3.8 or newer; version mismatches cause silent import errors rather than clear failure messages.
The -o sarif flag only produces SARIF 2.1.0; confirm your SIEM or code scanning platform supports that schema version before ingesting.
Checkov's graph-based checks for cross-resource relationships require the full Terraform directory to be present, not just individual files.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp