# Black Duck Security Scanner

Runs Black Duck Signal vulnerability analysis inside your AI coding assistant. It inspects local Git changes or targeted folders and returns SARIF reports.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1
- Author: blackducksoftware
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/blackducksoftware/mcp-server
- Updated: 2026-09-02
- HTML: https://affpapa.org/en/nevibecode/mcp/black-duck-security-scanner

## What it does

This server connects AI assistants with the Black Duck Signal analysis engine. It provides two tools. The `run_changes_security_scan` tool inspects Git modifications, checking either uncommitted edits or differences against a reference branch such as `main`. For projects without Git or targeted reviews, `run_security_scan` takes a list of absolute file and directory paths.

Scan outputs include a SARIF report file path, issue counts grouped by severity, and practical guidance for fixes. The tool runs on macOS, Linux, and Windows. Firewalls must permit outbound port 443 traffic to `repo.blackduck.com` and `llm.core.blackduck.com`.

Running the scanner requires Node.js 24.0.0 or newer, a valid Signal license, and the `BLACKDUCK_MCP_GATEWAY_KEY` environment variable. The server fails immediately without this key.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mcp-server -- npx -y @black-duck/mcp-server
```

### Codex

**Platform CLI**
```bash
codex mcp add black-duck-security-scanner -- npx -y @black-duck/mcp-server
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "black-duck-security-scanner": {
            "command": "npx",
            "args": [
                "-y",
                "@black-duck/mcp-server"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "black-duck-security-scanner": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@black-duck/mcp-server"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add black-duck-security-scanner npx -y @black-duck/mcp-server
```

## When to use it
- check uncommitted code changes for security flaws
- detect vulnerabilities between the current branch and `main`
- scan designated folders without relying on Git
- generate SARIF security reports with severity counts

## Example prompts
- Scan my uncommitted changes for security issues
- Check changed files in this branch against main for vulnerabilities
- Run a security scan on all files inside `src/api`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md