Blackduck MCP server
{
"mcpServers": {
"black-duck-signal": {
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server@latest"
],
"env": {
"BLACKDUCK_MCP_GATEWAY_KEY": "<blackduck_mcp_gateway_key>"
}
}
}
}{
"mcpServers": {
"black-duck-signal": {
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server@latest"
],
"env": {
"BLACKDUCK_MCP_GATEWAY_KEY": "<blackduck_mcp_gateway_key>"
}
}
}
}{
"mcpServers": {
"black-duck-signal": {
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server@latest"
],
"env": {
"BLACKDUCK_MCP_GATEWAY_KEY": "<blackduck_mcp_gateway_key>"
}
}
}
}{
"servers": {
"black-duck-signal": {
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server@latest"
],
"env": {
"BLACKDUCK_MCP_GATEWAY_KEY": "${input:blackduck_mcp_gateway_key}"
}
}
},
"inputs": [
{
"id": "blackduck_mcp_gateway_key",
"type": "promptString",
"description": "Blackduck mcp gateway key",
"password": true
}
]
}{
"mcpServers": {
"black-duck-signal": {
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server@latest"
],
"env": {
"BLACKDUCK_MCP_GATEWAY_KEY": "<blackduck_mcp_gateway_key>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @black-duck/mcp-serverversion 1.1.8
What it does
Black Duck MCP integrates AI-powered security scanning into coding assistants like Claude and Cursor. It scans code changes or specific files for vulnerabilities and provides actionable insights, requiring a Signal license and Node.js v24+.
- Scan code changes in git-based projects to detect security issues before committing
- Analyze specific files or directories in non-git projects for security vulnerabilities
- Review changes against a reference branch to identify issues introduced in the current branch
Tools this server exposes
| Tool | Does |
|---|---|
| run_changes_security_scan | Performs incremental security scans on git-tracked code changes, with options to scan staged/unstaged changes or changes relative to a reference branch |
| run_security_scan | Runs targeted security analysis on specified files or directories, returning results in SARIF format with issue counts and analysis guidance |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.