Black Duck Security Scanner

com.blackduck由 blackduck.com 发布v1.1.8更新于 Oct 24, 2026

AI-powered security scanning using Black Duck Signal for vulnerability detection.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

Black Duck MCP 在编程助手中运行 AI 驱动的代码安全扫描，报告漏洞并给出修复建议。

可以做什么
  • 扫描 Git 项目中未提交的改动或分支差异，并按严重程度汇总问题
  • 扫描指定的文件或目录，也适用于非 Git 项目
  • 每次扫描返回 SARIF 报告路径、问题数量统计和分析指引
  • 仅针对改动代码做增量扫描，节省时间与成本
适用场景
适合在不离开助手的情况下，对正在编写的代码做漏洞检查，可针对当前改动或指定文件与目录。适用于开发早期的快速发现，以及关键路径的重点审查。
运行要求
以 stdio 方式在本地运行，可通过 npx 或 MCP 安装包启动。需要 Node.js v24.0.0 或更高版本，以及 Black Duck Signal 许可证，通过环境变量 BLACKDUCK_MCP_GATEWAY_KEY 提供。需允许访问 Black Duck 的 repo.blackduck.com 与 llm.core.blackduck.com 出站 HTTPS。基于改动的扫描需要 Git。
安装前请注意
需要在 BLACKDUCK_MCP_GATEWAY_KEY 中提供 Black Duck Signal API 密钥，该密钥会发送至 Black Duck 服务。源代码和文件内容会上传到 Black Duck 进行分析，扫描专有或受监管代码前请确认合规要求。默认单次扫描最长 30 分钟，可能消耗许可的扫描额度。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Black Duck Security Scanner，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Black Duck MCP

Black Duck MCP brings Signal's AI-powered security analysis directly into your development environment. It enables code scanning through leading coding assistants – including Claude, Gemini, Cursor, Copilot, and others – so you can detect security issues, receive actionable insights, and apply recommended fixes quickly and consistently.

Key Features & Benefits

  • Changes Scan:
    • Performs fast, incremental security scans focused only on the code changes introduced by the developer.
    • Ideal for early-stage detection of issues as code is written
  • File Scan:
    • Runs a targeted security analysis on specific files or directories.
    • Best suited for projects that do not use Git or for developers who want to analyze specific portions of the codebase
  • Cross-Platform Support:
    • Works on Windows, macOS, and Linux

Requirements

Getting started

Step 1: Add to your MCP client

Add the following configuration to your MCP client (using Claude user level config as example):

json
{  "mcpServers": {    "black-duck-signal": {      "command": "npx",      "args": ["-y", "@black-duck/mcp-server"],      "env": {        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here"      }    }  }}

Step 2: Your first scan

Use one of following prompts in your MCP client to get you started:

Scan my code changes for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Scan the changed files with respect to the main branch

Your MCP client should execute a security scan taking into account only code changes in the current branch vs the main branch and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Scan all files under folder foobar for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found.

Tools

ToolParametersReturnsBest Use Cases
run_changes_security_scanprojectPath (required): Absolute path to git project

gitPatchMode (required):
• all-uncommitted: Scan staged + unstaged changes
• reference-branch: Scan changes since branching

referenceBranch (optional): Reference branch name (e.g., main)

scanEntireFileContent (optional): When true, scans entire content of changed files instead of just changed lines. Default: false		• sarifFilePath: Path to SARIF report
• status: success or failure
• resourceUris: MCP resource URIs
• issueCounts: Counts by severity
• analysisGuidance: Analysis steps		• Faster: Analyzes only changed code
• Focused: Shows issues from your changes
• Iterative: Perfect for dev workflows & CI/CD
• Efficient: Reduces scan cost and time
run_security_scanprojectPath (required): Absolute path to project

filePaths (required): Array of file/directory absolute paths to scan		• sarifFilePath: Path to SARIF report
• status: success or failure
• resourceUris: MCP resource URIs
• issueCounts: Counts by severity
• analysisGuidance: Analysis steps		• Analyzing specific files/directories
• Focused security review of critical paths
• Quick checks during development
• Non-git projects

Optional Configuration

The Black Duck Signal MCP server supports the following environment variables:

VariableDefaultDescription
BLACKDUCK_MCP_GATEWAY_KEYNone (required)API key for enhanced AI analysis
BLACKDUCK_HOMEUser's home directoryOverride the default .blackduck folder location
BLACKDUCK_MCP_TOOL_TIMEOUT1800000 (30 min)Scan timeout in milliseconds
BLACKDUCK_MCP_LOG_LEVELinfoLog level: error, warn, info, or debug

You can set these variables in your MCP client configuration:

json
{  "mcpServers": {    "black-duck": {      "command": "npx",      "args": ["-y", "@black-duck/mcp-server"],      "env": {        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here",        "BLACKDUCK_MCP_LOG_LEVEL": "debug"      }    }  }}

Logging and Troubleshooting

Log Location

All MCP logs are written to /Users/<username>/.blackduck/mcp/logs/ for linux/mac and C:\Users\<Username>\AppData\Roaming\BlackDuck\mcp\logs\ (customizable via BLACKDUCK_HOME):

  • black-duck-mcp.log - Combined log (all levels)
  • black-duck-mcp-error.log - Error-only log

IP Allowlist

The following URLs and IP addresses must be accessible for the MCP server to function properly:

URLIP Address
repo.blackduck.com34.149.5.115
llm.core.blackduck.com104.18.36.253

Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints

License

This project is licensed under the MIT License.

Resources

来源：README.md，提交 36f7aa6

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v1.1.8最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分