Black Duck Security Scanner

AI-powered security scanning using Black Duck Signal for vulnerability detection.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "black-duck-security-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Capabilities & Tool Schemas (2)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Black Duck Security Scanner.

run_changes_security_scan

• **Faster**: Analyzes only changed code • **Focused**: Shows issues from your changes • **Iterative**: Perfect for dev workflows & CI/CD • **Efficient**: Reduces scan cost and time

run_security_scan

• Analyzing specific files/directories • Focused security review of critical paths • Quick checks during development • Non-git projects

Documentation Overview

Black Duck MCP

Black Duck MCP brings Signal's AI-powered security analysis directly into your development environment. It enables code scanning through leading coding assistants – including Claude, Gemini, Cursor, Copilot, and others – so you can detect security issues, receive actionable insights, and apply recommended fixes quickly and consistently.

Key Features & Benefits

Changes Scan:
- Performs fast, incremental security scans focused only on the code changes introduced by the developer.
- Ideal for early-stage detection of issues as code is written
File Scan:
- Runs a targeted security analysis on specific files or directories.
- Best suited for projects that do not use Git or for developers who want to analyze specific portions of the codebase
Cross-Platform Support:
- Works on Windows, macOS, and Linux

Requirements

Signal License
Node.js v24.0.0 or newer

Getting started

Step 1: Add to your MCP client

Add the following configuration to your MCP client (using Claude user level config as example):

config.json

{
  "mcpServers": {
    "black-duck-signal": {
      "command": "npx",
      "args": ["-y", "@black-duck/mcp-server"],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here"
      }
    }
  }
}

Step 2: Your first scan

Use one of following prompts in your MCP client to get you started:

Code

Scan my code changes for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Code

Scan the changed files with respect to the main branch

Your MCP client should execute a security scan taking into account only code changes in the current branch vs the main branch and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Code

Scan all files under folder foobar for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found.

Tools

Tool	Parameters	Returns	Best Use Cases
`run_changes_security_scan`	`projectPath` (required): Absolute path to git project `gitPatchMode` (required): • `all-uncommitted`: Scan staged + unstaged changes • `reference-branch`: Scan changes since branching `referenceBranch` (optional): Reference branch name (e.g., `main`) `scanEntireFileContent` (optional): When `true`, scans entire content of changed files instead of just changed lines. Default: `false`	• `sarifFilePath`: Path to SARIF report • `status`: `success` or `failure` • `resourceUris`: MCP resource URIs • `issueCounts`: Counts by severity • `analysisGuidance`: Analysis steps	• Faster: Analyzes only changed code • Focused: Shows issues from your changes • Iterative: Perfect for dev workflows & CI/CD • Efficient: Reduces scan cost and time
`run_security_scan`	`projectPath` (required): Absolute path to project `filePaths` (required): Array of file/directory absolute paths to scan	• `sarifFilePath`: Path to SARIF report • `status`: `success` or `failure` • `resourceUris`: MCP resource URIs • `issueCounts`: Counts by severity • `analysisGuidance`: Analysis steps	• Analyzing specific files/directories • Focused security review of critical paths • Quick checks during development • Non-git projects

Optional Configuration

The Black Duck Signal MCP server supports the following environment variables:

Variable	Default	Description
`BLACKDUCK_MCP_GATEWAY_KEY`	None (required)	API key for enhanced AI analysis
`BLACKDUCK_HOME`	User's home directory	Override the default `.blackduck` folder location
`BLACKDUCK_MCP_TOOL_TIMEOUT`	`1800000` (30 min)	Scan timeout in milliseconds
`BLACKDUCK_MCP_LOG_LEVEL`	`info`	Log level: `error`, `warn`, `info`, or `debug`

You can set these variables in your MCP client configuration:

config.json

{
  "mcpServers": {
    "black-duck": {
      "command": "npx",
      "args": ["-y", "@black-duck/mcp-server"],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here",
        "BLACKDUCK_MCP_LOG_LEVEL": "debug"
      }
    }
  }
}

Logging and Troubleshooting

Log Location

All MCP logs are written to /Users/<username>/.blackduck/mcp/logs/ for linux/mac and C:\Users\<Username>\AppData\Roaming\BlackDuck\mcp\logs\ (customizable via BLACKDUCK_HOME):

black-duck-mcp.log - Combined log (all levels)
black-duck-mcp-error.log - Error-only log

IP Allowlist

The following URLs and IP addresses must be accessible for the MCP server to function properly:

URL	IP Address
`repo.blackduck.com`	`34.149.5.115`
`llm.core.blackduck.com`	`104.18.36.253`

Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints

License

This project is licensed under the MIT License.

Resources

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads

933

Package downloads in the last 30 days.

Last commit

22d ago

Most recent push to the default branch.

Tools exposed

Callable tools this server registers over MCP.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Black Duck Security Scanner

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "black-duck-security-scanner": { "command": "npx", "args": ["-y","@black-duck/mcp-server"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Black Duck Security Scanner AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/black-duck-security-scanner?style=directory)](https://allmcps.com/mcp/black-duck-security-scanner)

HTML Embed

<a href="https://allmcps.com/mcp/black-duck-security-scanner"><img src="https://allmcps.com/api/badge/black-duck-security-scanner?style=directory" alt="Black Duck Security Scanner on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

16/16 checks healthy over the last 46d

55Quality signal: Good · 55/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools24/30

Adoption & activity7/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · @black-duck/mcp-server (npm)

★ Featured

AllMCPs Server

The official MCP server for AllMCPs.com - submit and manage tools directly from your AI. The open directory for MCP servers. Connect Claude, Cursor, Windsurf, and AI agents to databases, tools, files, and APIs. Explore 10,000+ servers. AllMCPs is the premier, open directory for discovering, evaluating, and installing Model Context Protocol (MCP) servers to equip AI agents and LLMs with real-world superpowers.

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Black Duck Security Scanner →Install in Claude Desktop Install in Cursor Install in VS Code Setup guides for all 13 MCP clients

Black Duck Security Scanner

AI-powered security scanning using Black Duck Signal for vulnerability detection.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "black-duck-security-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Capabilities & Tool Schemas (2)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Black Duck Security Scanner.

run_changes_security_scan

• **Faster**: Analyzes only changed code • **Focused**: Shows issues from your changes • **Iterative**: Perfect for dev workflows & CI/CD • **Efficient**: Reduces scan cost and time

run_security_scan

• Analyzing specific files/directories • Focused security review of critical paths • Quick checks during development • Non-git projects

Documentation Overview

Black Duck MCP

Key Features & Benefits

Changes Scan:
- Performs fast, incremental security scans focused only on the code changes introduced by the developer.
- Ideal for early-stage detection of issues as code is written
File Scan:
- Runs a targeted security analysis on specific files or directories.
- Best suited for projects that do not use Git or for developers who want to analyze specific portions of the codebase
Cross-Platform Support:
- Works on Windows, macOS, and Linux

Requirements

Signal License
Node.js v24.0.0 or newer

Getting started

Step 1: Add to your MCP client

Add the following configuration to your MCP client (using Claude user level config as example):

config.json

{
  "mcpServers": {
    "black-duck-signal": {
      "command": "npx",
      "args": ["-y", "@black-duck/mcp-server"],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here"
      }
    }
  }
}

Step 2: Your first scan

Use one of following prompts in your MCP client to get you started:

Code

Scan my code changes for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.

Code

Scan the changed files with respect to the main branch

Code

Scan all files under folder foobar for security vulnerabilities

Your MCP client should execute a security scan and report any vulnerabilities found.

Tools

Tool	Parameters	Returns	Best Use Cases
`run_changes_security_scan`	`projectPath` (required): Absolute path to git project `gitPatchMode` (required): • `all-uncommitted`: Scan staged + unstaged changes • `reference-branch`: Scan changes since branching `referenceBranch` (optional): Reference branch name (e.g., `main`) `scanEntireFileContent` (optional): When `true`, scans entire content of changed files instead of just changed lines. Default: `false`	• `sarifFilePath`: Path to SARIF report • `status`: `success` or `failure` • `resourceUris`: MCP resource URIs • `issueCounts`: Counts by severity • `analysisGuidance`: Analysis steps	• Faster: Analyzes only changed code • Focused: Shows issues from your changes • Iterative: Perfect for dev workflows & CI/CD • Efficient: Reduces scan cost and time
`run_security_scan`	`projectPath` (required): Absolute path to project `filePaths` (required): Array of file/directory absolute paths to scan	• `sarifFilePath`: Path to SARIF report • `status`: `success` or `failure` • `resourceUris`: MCP resource URIs • `issueCounts`: Counts by severity • `analysisGuidance`: Analysis steps	• Analyzing specific files/directories • Focused security review of critical paths • Quick checks during development • Non-git projects

Optional Configuration

The Black Duck Signal MCP server supports the following environment variables:

Variable	Default	Description
`BLACKDUCK_MCP_GATEWAY_KEY`	None (required)	API key for enhanced AI analysis
`BLACKDUCK_HOME`	User's home directory	Override the default `.blackduck` folder location
`BLACKDUCK_MCP_TOOL_TIMEOUT`	`1800000` (30 min)	Scan timeout in milliseconds
`BLACKDUCK_MCP_LOG_LEVEL`	`info`	Log level: `error`, `warn`, `info`, or `debug`

You can set these variables in your MCP client configuration:

config.json

{
  "mcpServers": {
    "black-duck": {
      "command": "npx",
      "args": ["-y", "@black-duck/mcp-server"],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "your-api-key-here",
        "BLACKDUCK_MCP_LOG_LEVEL": "debug"
      }
    }
  }
}

Logging and Troubleshooting

Log Location

All MCP logs are written to /Users/<username>/.blackduck/mcp/logs/ for linux/mac and C:\Users\<Username>\AppData\Roaming\BlackDuck\mcp\logs\ (customizable via BLACKDUCK_HOME):

black-duck-mcp.log - Combined log (all levels)
black-duck-mcp-error.log - Error-only log

IP Allowlist

The following URLs and IP addresses must be accessible for the MCP server to function properly:

URL	IP Address
`repo.blackduck.com`	`34.149.5.115`
`llm.core.blackduck.com`	`104.18.36.253`

Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints

License

This project is licensed under the MIT License.

Resources

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads

933

Package downloads in the last 30 days.

Last commit

22d ago

Most recent push to the default branch.

Tools exposed

Callable tools this server registers over MCP.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Black Duck Security Scanner

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "black-duck-security-scanner": { "command": "npx", "args": ["-y","@black-duck/mcp-server"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/black-duck-security-scanner?style=directory)](https://allmcps.com/mcp/black-duck-security-scanner)

HTML Embed

<a href="https://allmcps.com/mcp/black-duck-security-scanner"><img src="https://allmcps.com/api/badge/black-duck-security-scanner?style=directory" alt="Black Duck Security Scanner on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

16/16 checks healthy over the last 46d

55Quality signal: Good · 55/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools24/30

Adoption & activity7/15

Community engagement0/10

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · @black-duck/mcp-server (npm)

★ Featured

AllMCPs Server

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.