Black Duck Security Scanner

com.blackduck由 blackduck.com 發布v1.1.8更新於 Oct 24, 2026

AI-powered security scanning using Black Duck Signal for vulnerability detection.

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

Black Duck MCP 在程式輔助工具中執行 AI 驅動的程式碼安全掃描，回報弱點並提供修正建議。

可以做什麼
  • 掃描 Git 專案中未提交的變更或分支差異，並依嚴重程度彙整問題
  • 掃描指定的檔案或目錄，也適用於非 Git 專案
  • 每次掃描回傳 SARIF 報告路徑、問題數量統計與分析指引
  • 只針對變更的程式碼做增量掃描，節省時間與成本
適用情境
適合在不離開輔助工具的情況下，對正在撰寫的程式碼做弱點檢查，可針對目前變更或指定檔案與目錄。適用於開發初期的及早發現，以及關鍵路徑的重點審查。
執行需求
以 stdio 方式在本機執行，可透過 npx 或 MCP 安裝包啟動。需要 Node.js v24.0.0 或更新版本，以及 Black Duck Signal 授權，透過環境變數 BLACKDUCK_MCP_GATEWAY_KEY 提供。需允許對 repo.blackduck.com 與 llm.core.blackduck.com 的對外 HTTPS 連線。以變更為基礎的掃描需要 Git。
安裝前請注意
需在 BLACKDUCK_MCP_GATEWAY_KEY 中提供 Black Duck Signal API 金鑰，該金鑰會傳送至 Black Duck 服務。原始碼與檔案內容會上傳至 Black Duck 進行分析，掃描專有或受監管的程式碼前請先確認合規要求。單次掃描預設最長 30 分鐘，可能消耗授權的掃描額度。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Black Duck Security Scanner，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Black Duck MCP

Black Duck MCP brings Signal's AI-powered security analysis directly into your development environment. It enables code scanning through leading coding assistants – including Claude, Gemini, Cursor, Copilot, and others – so you can detect security issues, receive actionable insights, and apply recommended fixes quickly and consistently.

Key Features & Benefits

  • Changes Scan:
    • Performs fast, incremental security scans focused only on the code changes introduced by the developer.
    • Ideal for early-stage detection of issues as code is written
  • File Scan:
    • Runs a targeted security analysis on specific files or directories.
    • Best suited for projects that do not use Git or for developers who want to analyze specific portions of the codebase
  • Cross-Platform Support:
    • Works on Windows, macOS, and Linux

Requirements

Getting started

Step 1: Add to your MCP client

Add the following configuration to your MCP client (using Claude user level config as example):

json
{  "mcpServers": {    "black-duck-signal": {      "command": "npx",      "args": ["-y", "@black-duck/mcp-server"],      "env": {        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here"      }    }  }}

Step 2: Your first scan

Use one of following prompts in your MCP client to get you started:

Scan my code changes for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Scan the changed files with respect to the main branch

Your MCP client should execute a security scan taking into account only code changes in the current branch vs the main branch and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Scan all files under folder foobar for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found.

Tools

ToolParametersReturnsBest Use Cases
run_changes_security_scanprojectPath (required): Absolute path to git project

gitPatchMode (required):
• all-uncommitted: Scan staged + unstaged changes
• reference-branch: Scan changes since branching

referenceBranch (optional): Reference branch name (e.g., main)

scanEntireFileContent (optional): When true, scans entire content of changed files instead of just changed lines. Default: false		• sarifFilePath: Path to SARIF report
• status: success or failure
• resourceUris: MCP resource URIs
• issueCounts: Counts by severity
• analysisGuidance: Analysis steps		• Faster: Analyzes only changed code
• Focused: Shows issues from your changes
• Iterative: Perfect for dev workflows & CI/CD
• Efficient: Reduces scan cost and time
run_security_scanprojectPath (required): Absolute path to project

filePaths (required): Array of file/directory absolute paths to scan		• sarifFilePath: Path to SARIF report
• status: success or failure
• resourceUris: MCP resource URIs
• issueCounts: Counts by severity
• analysisGuidance: Analysis steps		• Analyzing specific files/directories
• Focused security review of critical paths
• Quick checks during development
• Non-git projects

Optional Configuration

The Black Duck Signal MCP server supports the following environment variables:

VariableDefaultDescription
BLACKDUCK_MCP_GATEWAY_KEYNone (required)API key for enhanced AI analysis
BLACKDUCK_HOMEUser's home directoryOverride the default .blackduck folder location
BLACKDUCK_MCP_TOOL_TIMEOUT1800000 (30 min)Scan timeout in milliseconds
BLACKDUCK_MCP_LOG_LEVELinfoLog level: error, warn, info, or debug

You can set these variables in your MCP client configuration:

json
{  "mcpServers": {    "black-duck": {      "command": "npx",      "args": ["-y", "@black-duck/mcp-server"],      "env": {        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here",        "BLACKDUCK_MCP_LOG_LEVEL": "debug"      }    }  }}

Logging and Troubleshooting

Log Location

All MCP logs are written to /Users/<username>/.blackduck/mcp/logs/ for linux/mac and C:\Users\<Username>\AppData\Roaming\BlackDuck\mcp\logs\ (customizable via BLACKDUCK_HOME):

  • black-duck-mcp.log - Combined log (all levels)
  • black-duck-mcp-error.log - Error-only log

IP Allowlist

The following URLs and IP addresses must be accessible for the MCP server to function properly:

URLIP Address
repo.blackduck.com34.149.5.115
llm.core.blackduck.com104.18.36.253

Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints

License

This project is licensed under the MIT License.

Resources

來源：README.md，提交 36f7aa6

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.1.8最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分