Black Duck Signal

listing.by

Scan code changes or specific files for security vulnerabilities with Black Duck Signal AI analysis, from your coding assistant.

state.local.long (state.local.title)listing.badge.runs_withstate.key.long

listing.install

listing.local.explain

npx -y @black-duck/mcp-server

listing.local.needs listing.local.note

  • BLACKDUCK_MCP_GATEWAY_KEY listing.env.secret Black Duck Signal API key (required).
act.add_to a11y.new_tab

listing.share.h

listing.share.p_local

mcp.tc/i/black-duck

listing.about

Connects your coding assistant to Black Duck Signal, an AI-assisted application security analysis service. It can scan only the code changes in a git project, either uncommitted changes or changes against a reference branch, or scan specific files and directories. Each scan returns a SARIF report path, a status, issue counts by severity and guidance for analyzing the findings.

Runs locally over stdio with npx and requires Node.js 24 or newer. A Black Duck Signal license is needed, and the key is passed in the BLACKDUCK_MCP_GATEWAY_KEY environment variable. The server must be able to reach repo.blackduck.com and llm.core.blackduck.com over HTTPS.

listing.can

  • Scan uncommitted git changes for security issues
  • Scan changes since branching from a reference branch
  • Scan specific files or directories, including non-git projects
  • Get a SARIF report with issue counts by severity
  • Receive guidance for analyzing and fixing findings
  • Works on Windows, macOS and Linux

listing.tools

listing.notools.key

listing.prompts

  • Scan my code changes for security vulnerabilities

  • Scan the changed files with respect to the main branch

  • Scan all files under the src/auth folder for security vulnerabilities

  • Run a security scan on server.js and summarize the issues by severity

listing.setup.h

listing.setup.local

Claude Code

  1. Run this in a terminal, in your project folder:
claude mcp add --transport stdio black-duck --env "BLACKDUCK_MCP_GATEWAY_KEY=<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>" -- npx -y @black-duck/mcp-server
  1. Start Claude Code and type /mcp. black-duck should show as connected.

Add --scope user to make it available in every project. Replace the placeholders with your own values.

Claude Desktop

  1. Open Settings → Developer → Edit Config. It opens claude_desktop_config.json. Add:
claude_desktop_config.json
{
  "mcpServers": {
    "black-duck": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>"
      }
    }
  }
}
  1. Save the file and restart Claude Desktop. Replace the placeholders with your own values.

Needs Node.js on your computer. The file lives in ~/Library/Application Support/Claude/ on macOS and %APPDATA%\Claude\ on Windows.

Cursor

Add to Cursor a11y.new_tab

Or add it by hand to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project):

mcp.json
{
  "mcpServers": {
    "black-duck": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>"
      }
    }
  }
}

Needs Node.js on your computer. Replace the placeholders with your own values.

VS Code

Add it to .vscode/mcp.json. VS Code asks for the secret the first time and stores it securely:

.vscode/mcp.json
{
  "servers": {
    "black-duck": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "${input:blackduck-mcp-gateway-key}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "blackduck-mcp-gateway-key",
      "description": "BLACKDUCK_MCP_GATEWAY_KEY",
      "password": true
    }
  ]
}

Needs Node.js on your computer.

Devin Desktop

  1. Add it to ~/.config/devin/mcp_config.json (macOS and Linux) or %APPDATA%\devin\mcp_config.json (Windows):
mcp_config.json
{
  "mcpServers": {
    "black-duck": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>"
      }
    }
  }
}
  1. Refresh the MCP server list in Cascade. Replace the placeholders with your own values.

Devin Desktop is the new name for Windsurf.

Codex

codex mcp add black-duck --env "BLACKDUCK_MCP_GATEWAY_KEY=<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>" -- npx -y @black-duck/mcp-server

Or edit ~/.codex/config.toml directly:

config.toml
[mcp_servers.black-duck]
command = "npx"
args = ["-y", "@black-duck/mcp-server"]
env = { BLACKDUCK_MCP_GATEWAY_KEY = "<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>" }

Needs Node.js on your computer. Replace the placeholders with your own values.

Gemini CLI

gemini mcp add -e "BLACKDUCK_MCP_GATEWAY_KEY=<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>" black-duck npx -- -y @black-duck/mcp-server

This adds it to the current project. Add -s user to use it everywhere.

Any client

Most clients that start local servers accept this shape:

{
  "mcpServers": {
    "black-duck": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server"
      ],
      "env": {
        "BLACKDUCK_MCP_GATEWAY_KEY": "<YOUR_BLACKDUCK_MCP_GATEWAY_KEY>"
      }
    }
  }
}

Zed puts servers under context_servers in its settings, with the same command, args and env fields.

Needs Node.js on your computer. Replace the placeholders with your own values.

listing.faq

Can I paste mcp.tc/i/black-duck into my MCP client?

No. Black Duck Signal runs on your own computer, started by your client, so it has no web address to connect to. The quick link is the page to share; the install command is npx -y @black-duck/mcp-server.

Does Black Duck Signal need an API key?

Yes. It reads BLACKDUCK_MCP_GATEWAY_KEY from its environment, and BLACKDUCK_MCP_GATEWAY_KEY is a secret. Put the value in your client's config on your own machine, never in a shared file.

Is Black Duck Signal a remote or a local server?

Local. Your client starts it as a process on your computer with npx -y @black-duck/mcp-server, which needs Node.js.

What can Black Duck Signal do?

You can scan uncommitted git changes for security issues, scan changes since branching from a reference branch and scan specific files or directories, including non-git projects.

Which clients can use it?

Any client that starts local servers: Claude Code, Claude Desktop, Cursor, VS Code, Devin Desktop, Codex, Gemini CLI, Zed and others. claude.ai and ChatGPT only connect to remote servers.

Who wrote this page?

mcp.tc's robot read Black Duck Signal's public metadata (its package and repository pages), and an AI model drafted the text from it. A person reviews anything the checks can't confirm. The text can still be wrong, so if you spot a mistake, use Report this listing on this page.

listing.em.h

listing.em.lead_local listing.em.how

listing.em.badge

em.prev_lightem.prev_dark
Markdown
[![Black Duck Signal on mcp.tc](https://mcp.tc/i/black-duck/badge.svg)](https://mcp.tc/i/black-duck)
HTML
<a href="https://mcp.tc/i/black-duck"><img src="https://mcp.tc/i/black-duck/badge.svg" alt="Black Duck Signal on mcp.tc" height="20"></a>

listing.em.badge_note

listing.em.widget

HTML
<script src="https://mcp.tc/w/black-duck.js" async></script>

listing.em.widget_note

iframe

HTML
<iframe src="https://mcp.tc/embed/black-duck" title="Black Duck Signal on mcp.tc" width="420" height="200" loading="lazy" allow="clipboard-write" style="border:0;border-radius:8px;max-width:100%"></iframe>

listing.em.iframe_note

JSON

listing.em.json_local

https://mcp.tc/i/black-duck.json

listing.em.fields

listing.related

listing.more_in

  • Snykvf.sr

    Security & Compliance

    state.local.label (state.local.title)

    Scan code, dependencies, containers, IaC and secrets for vulnerabilities with Snyk from your AI assistant.

    mcp.tc/i/snyk

  • Auth0vf.sr

    Auth0 (Okta)

    state.local.label (state.local.title)

    Manage Auth0 applications, APIs, actions, logs, forms and client grants in your tenant using natural language.

    mcp.tc/i/auth0

  • IDA Pro MCP

    mrexodia

    state.local.label (state.local.title)

    Reverse engineer binaries in IDA Pro: decompile, rename, comment and retype functions through your AI assistant.

    mcp.tc/i/ida-pro

  • Burp Suite

    PortSwigger

    state.local.label (state.local.title)

    Drive Burp Suite from AI clients through an extension that exposes Burp over MCP, with an SSE endpoint and a bundled stdio proxy.

    mcp.tc/i/burp-suite

  • CrowdStrike Falconvf.sr

    CrowdStrike

    state.local.label (state.local.title)

    Query CrowdStrike Falcon detections, hosts, threat intel, vulnerabilities and more from your AI assistant.

    mcp.tc/i/crowdstrike-falcon

  • Oktavf.sr

    Security & Compliance

    state.local.label (state.local.title)

    Manage Okta users, groups, applications, policies and system logs from your assistant using natural language.

    mcp.tc/i/okta

listing.disclaimer_checked