Black Duck Security Scanner — Claude Code MCP server setup
Runs Black Duck Signal vulnerability analysis inside your AI coding assistant. It inspects local Git changes or targeted folders and returns SARIF reports.
claude mcp add mcp-server -- npx -y @black-duck/mcp-serverWhat Black Duck Security Scanner does
This server connects AI assistants with the Black Duck Signal analysis engine. It provides two tools. The run_changes_security_scan tool inspects Git modifications, checking either uncommitted edits or differences against a reference branch such as main. For projects without Git or targeted reviews, run_security_scan takes a list of absolute file and directory paths.
Scan outputs include a SARIF report file path, issue counts grouped by severity, and practical guidance for fixes. The tool runs on macOS, Linux, and Windows. Firewalls must permit outbound port 443 traffic to repo.blackduck.com and llm.core.blackduck.com.
Running the scanner requires Node.js 24.0.0 or newer, a valid Signal license, and the BLACKDUCK_MCP_GATEWAY_KEY environment variable. The server fails immediately without this key.
What it helps with
- check uncommitted code changes for security flaws
- detect vulnerabilities between the current branch and
main - scan designated folders without relying on Git
- generate SARIF security reports with severity counts
Example prompts for the agent
- Scan my uncommitted changes for security issues
- Check changed files in this branch against main for vulnerabilities
- Run a security scan on all files inside
src/api
How to install Black Duck Security Scanner
Platform CLI
claude mcp add mcp-server -- npx -y @black-duck/mcp-serverPlatform CLI
codex mcp add black-duck-security-scanner -- npx -y @black-duck/mcp-serverConfig file
{
"mcpServers": {
"black-duck-security-scanner": {
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server"
]
}
}
}Config file
{
"servers": {
"black-duck-security-scanner": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@black-duck/mcp-server"
]
}
}
}Platform CLI
gemini mcp add black-duck-security-scanner npx -y @black-duck/mcp-serverStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Black Duck Security Scanner
How do I install Black Duck Security Scanner in Claude Code?
Run claude mcp add black-duck-security-scanner -- npx -y @black-duck/mcp-server in your terminal. You must supply your API key in the BLACKDUCK_MCP_GATEWAY_KEY environment variable.
What does Black Duck Security Scanner do?
It connects your AI assistant to Black Duck Signal, scanning code changes or specific folders for security vulnerabilities and returning SARIF reports with remediation hints.
What are the prerequisites for running this MCP server?
You need Node.js version 24.0.0 or newer, a valid Signal license, and outbound HTTPS access to repo.blackduck.com and llm.core.blackduck.com.
