Black Duck Security Scanner

What the Black Duck Security Scanner MCP server does

The Black Duck Security Scanner MCP server exposes Black Duck Signal analysis through the Model Context Protocol. It lets a coding assistant request a security scan and receive structured results instead of requiring a developer to leave the development environment.

Two scan modes are available:

• Change scanning examines code modifications in a Git project. It can include staged and unstaged changes, or compare the current branch with a reference branch such as main.
• File scanning analyzes explicitly selected files or directories. This mode is suitable for targeted reviews and projects that do not use Git.

The server works on Windows, macOS, and Linux. A Signal license and Node.js 24.0.0 or newer are required.

How it works

The Black Duck Security Scanner MCP server runs as an MCP process configured with npx and the @black-duck/mcp-server package. An MCP client sends a scan request with absolute project and file paths. The server contacts Black Duck services for analysis and returns a status, SARIF report location, resource URIs, issue counts by severity, and analysis guidance.

Change scans require a Git project so the server can determine which files or lines changed. The all-uncommitted mode covers staged and unstaged work. The reference-branch mode compares the current branch with a named branch. By default, only changed content is scanned; scanEntireFileContent can request analysis of the full contents of changed files.

The Black Duck Security Scanner MCP server requires outbound HTTPS access to repo.blackduck.com at 34.149.5.115 and llm.core.blackduck.com at 104.18.36.253.

Setup and configuration

Add the server to an MCP client using the npx command and provide BLACKDUCK_MCP_GATEWAY_KEY in the server environment. This key is required for the enhanced AI analysis described by the project. The package can be launched without a separate local executable installation when the client uses the documented npx -y @black-duck/mcp-server configuration.

Optional settings include:

• BLACKDUCK_HOME changes the default location of the .blackduck data and log directory.
• BLACKDUCK_MCP_TOOL_TIMEOUT sets the scan timeout in milliseconds; its default is 1,800,000 milliseconds.
• BLACKDUCK_MCP_LOG_LEVEL controls logging with error, warn, info, or debug; the default is info.

Logs are stored under the Black Duck home directory. On Linux and macOS, the default log path is ~/.blackduck/mcp/logs/. On Windows, it is under the user's application data directory. The log directory contains combined and error-only log files.

Tools and capabilities

The Black Duck Security Scanner MCP server exposes these tools:

• run_changes_security_scan accepts an absolute Git project path, a required patch mode, an optional reference branch, and an optional full-file setting. It returns scan status, a SARIF path, MCP resource URIs, severity counts, and analysis steps.
• run_security_scan accepts an absolute project path and an array of absolute file or directory paths. It returns the same result categories and supports focused reviews without requiring Git.

The tools support iterative development checks, reviews of critical paths, scans of changed code, and security checks in non-Git projects. Scan results identify issue counts by severity and provide analysis guidance for follow-up work.

Limitations and notes

A Signal license is required, and the runtime must use Node.js 24.0.0 or newer. Change scanning cannot determine modifications without a Git-based project. Both tools use absolute paths for project and file locations.

Network access must permit outbound HTTPS on port 443 to the documented Black Duck endpoints. Scan duration is governed by the tool timeout, which defaults to 30 minutes. The project is licensed under MIT.