Black Duck Security Scanner

com.blackduckPublished by blackduck.comv1.1.8Updated Oct 24, 2026

AI-powered security scanning using Black Duck Signal for vulnerability detection.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Black Duck MCP runs AI-powered security scans on your code from inside a coding assistant, reporting vulnerabilities and fix guidance.

What you can do
  • Scan uncommitted or branch changes in a Git project and report issues by severity
  • Scan specific files or directories, including in projects that are not Git-based
  • Return a SARIF report path, issue counts and analysis guidance for each scan
  • Run incremental scans focused only on changed code to save time and cost
When to use it
Use it when you want vulnerability checks on code you are writing without leaving the assistant, either on your current changes or on chosen files and folders. Suited to early-stage detection during development and to focused reviews of critical paths.
Requirements
Runs locally over stdio via npx or an MCP bundle. Needs Node.js v24.0.0 or newer and a Black Duck Signal license, supplied through the BLACKDUCK_MCP_GATEWAY_KEY environment variable. Outbound HTTPS to Black Duck endpoints (repo.blackduck.com, llm.core.blackduck.com) must be allowed. Git is needed for change-based scans.
Before you install
Requires a Black Duck Signal API key in BLACKDUCK_MCP_GATEWAY_KEY, which is sent to Black Duck services. Source code and file contents are uploaded to Black Duck for analysis, so check policy before scanning proprietary or regulated code. Scans can run up to 30 minutes by default and may consume licensed scan capacity.

Installation

In SourceWeft

  1. Open Black Duck Security Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Black Duck MCP

Black Duck MCP brings Signal's AI-powered security analysis directly into your development environment. It enables code scanning through leading coding assistants – including Claude, Gemini, Cursor, Copilot, and others – so you can detect security issues, receive actionable insights, and apply recommended fixes quickly and consistently.

Key Features & Benefits

  • Changes Scan:
    • Performs fast, incremental security scans focused only on the code changes introduced by the developer.
    • Ideal for early-stage detection of issues as code is written
  • File Scan:
    • Runs a targeted security analysis on specific files or directories.
    • Best suited for projects that do not use Git or for developers who want to analyze specific portions of the codebase
  • Cross-Platform Support:
    • Works on Windows, macOS, and Linux

Requirements

Getting started

Step 1: Add to your MCP client

Add the following configuration to your MCP client (using Claude user level config as example):

json
{  "mcpServers": {    "black-duck-signal": {      "command": "npx",      "args": ["-y", "@black-duck/mcp-server"],      "env": {        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here"      }    }  }}

Step 2: Your first scan

Use one of following prompts in your MCP client to get you started:

Scan my code changes for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Scan the changed files with respect to the main branch

Your MCP client should execute a security scan taking into account only code changes in the current branch vs the main branch and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Scan all files under folder foobar for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found.

Tools

ToolParametersReturnsBest Use Cases
run_changes_security_scanprojectPath (required): Absolute path to git project

gitPatchMode (required):
• all-uncommitted: Scan staged + unstaged changes
• reference-branch: Scan changes since branching

referenceBranch (optional): Reference branch name (e.g., main)

scanEntireFileContent (optional): When true, scans entire content of changed files instead of just changed lines. Default: false		• sarifFilePath: Path to SARIF report
• status: success or failure
• resourceUris: MCP resource URIs
• issueCounts: Counts by severity
• analysisGuidance: Analysis steps		• Faster: Analyzes only changed code
• Focused: Shows issues from your changes
• Iterative: Perfect for dev workflows & CI/CD
• Efficient: Reduces scan cost and time
run_security_scanprojectPath (required): Absolute path to project

filePaths (required): Array of file/directory absolute paths to scan		• sarifFilePath: Path to SARIF report
• status: success or failure
• resourceUris: MCP resource URIs
• issueCounts: Counts by severity
• analysisGuidance: Analysis steps		• Analyzing specific files/directories
• Focused security review of critical paths
• Quick checks during development
• Non-git projects

Optional Configuration

The Black Duck Signal MCP server supports the following environment variables:

VariableDefaultDescription
BLACKDUCK_MCP_GATEWAY_KEYNone (required)API key for enhanced AI analysis
BLACKDUCK_HOMEUser's home directoryOverride the default .blackduck folder location
BLACKDUCK_MCP_TOOL_TIMEOUT1800000 (30 min)Scan timeout in milliseconds
BLACKDUCK_MCP_LOG_LEVELinfoLog level: error, warn, info, or debug

You can set these variables in your MCP client configuration:

json
{  "mcpServers": {    "black-duck": {      "command": "npx",      "args": ["-y", "@black-duck/mcp-server"],      "env": {        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here",        "BLACKDUCK_MCP_LOG_LEVEL": "debug"      }    }  }}

Logging and Troubleshooting

Log Location

All MCP logs are written to /Users/<username>/.blackduck/mcp/logs/ for linux/mac and C:\Users\<Username>\AppData\Roaming\BlackDuck\mcp\logs\ (customizable via BLACKDUCK_HOME):

  • black-duck-mcp.log - Combined log (all levels)
  • black-duck-mcp-error.log - Error-only log

IP Allowlist

The following URLs and IP addresses must be accessible for the MCP server to function properly:

URLIP Address
repo.blackduck.com34.149.5.115
llm.core.blackduck.com104.18.36.253

Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints

License

This project is licensed under the MIT License.

Resources

Source: README.md at commit 36f7aa6

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.1.8LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts