{
  "markdown": "# Black Duck MCP\n\nBlack Duck MCP brings Signal's AI-powered security analysis directly into your development environment. It enables code scanning through leading coding assistants – including Claude, Gemini, Cursor, Copilot, and others – so you can detect security issues, receive actionable insights, and apply recommended fixes quickly and consistently.\n\n## Key Features & Benefits\n\n- **Changes Scan**:\n  - Performs fast, incremental security scans focused only on the code changes introduced by the developer. \n  - Ideal for early-stage detection of issues as code is written\n- **File Scan**:\n  - Runs a targeted security analysis on specific files or directories. \n  - Best suited for projects that do not use Git or for developers who want to analyze specific portions of the codebase\n- **Cross-Platform Support**:\n  - Works on Windows, macOS, and Linux\n\n## Requirements\n\n- [Signal License](https://www.blackduck.com/signal-ai-appsec/early-access.html)\n- [Node.js](https://nodejs.org/) v24.0.0 or newer\n\n## Getting started\n\n### Step 1: Add to your MCP client\n\nAdd the following configuration to your MCP client (using Claude user level config as example):\n```json\n{\n  \"mcpServers\": {\n    \"black-duck-signal\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@black-duck/mcp-server\"],\n      \"env\": {\n        \"BLACKDUCK_MCP_GATEWAY_KEY\": \"your-api-key-here\"\n      }\n    }\n  }\n}\n```\n\n### Step 2: Your first scan\n\nUse one of following prompts in your MCP client to get you started:\n\n```\nScan my code changes for security vulnerabilities\n```\n\nYour MCP client should execute a security scan and report any vulnerabilities found on the **code changes made**. Requires that the project is git based to determine what files have changed.\n\n```\nScan the changed files with respect to the main branch\n```\n\nYour MCP client should execute a security scan taking into account **only code changes in the current branch** vs the main branch and report any vulnerabilities found on the code changes made. Requires that the project is git based to determine what files have changed.\n\n```\nScan all files under folder foobar for security vulnerabilities\n```\n\nYour MCP client should execute a security scan and report any vulnerabilities found.\n\n## Tools\n\n| Tool | Parameters | Returns | Best Use Cases |\n|------|------------|---------|----------------|\n| **`run_changes_security_scan`** | **`projectPath`** (required): Absolute path to git project<br><br>**`gitPatchMode`** (required):<br>• `all-uncommitted`: Scan staged + unstaged changes<br>• `reference-branch`: Scan changes since branching<br><br>**`referenceBranch`** (optional): Reference branch name (e.g., `main`)<br><br>**`scanEntireFileContent`** (optional): When `true`, scans entire content of changed files instead of just changed lines. Default: `false` | • `sarifFilePath`: Path to SARIF report<br>• `status`: `success` or `failure`<br>• `resourceUris`: MCP resource URIs<br>• `issueCounts`: Counts by severity<br>• `analysisGuidance`: Analysis steps | • **Faster**: Analyzes only changed code<br>• **Focused**: Shows issues from your changes<br>• **Iterative**: Perfect for dev workflows & CI/CD<br>• **Efficient**: Reduces scan cost and time |\n| **`run_security_scan`** | **`projectPath`** (required): Absolute path to project<br><br>**`filePaths`** (required): Array of file/directory absolute paths to scan | • `sarifFilePath`: Path to SARIF report<br>• `status`: `success` or `failure`<br>• `resourceUris`: MCP resource URIs<br>• `issueCounts`: Counts by severity<br>• `analysisGuidance`: Analysis steps | • Analyzing specific files/directories<br>• Focused security review of critical paths<br>• Quick checks during development<br>• Non-git projects |\n\n## Optional Configuration\n\nThe Black Duck Signal MCP server supports the following environment variables:\n\n| Variable | Default | Description |\n|----------|---------|-------------|\n| `BLACKDUCK_MCP_GATEWAY_KEY` | None (required) | API key for enhanced AI analysis |\n| `BLACKDUCK_HOME` | User's home directory | Override the default `.blackduck` folder location |\n| `BLACKDUCK_MCP_TOOL_TIMEOUT` | `1800000` (30 min) | Scan timeout in milliseconds |\n| `BLACKDUCK_MCP_LOG_LEVEL` | `info` | Log level: `error`, `warn`, `info`, or `debug` |\n\nYou can set these variables in your MCP client configuration:\n\n```json\n{\n  \"mcpServers\": {\n    \"black-duck\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@black-duck/mcp-server\"],\n      \"env\": {\n        \"BLACKDUCK_MCP_GATEWAY_KEY\": \"your-api-key-here\",\n        \"BLACKDUCK_MCP_LOG_LEVEL\": \"debug\"\n      }\n    }\n  }\n}\n```\n\n\n## Logging and Troubleshooting\n\n### Log Location\n\nAll MCP logs are written to `/Users/<username>/.blackduck/mcp/logs/` for linux/mac and `C:\\Users\\<Username>\\AppData\\Roaming\\BlackDuck\\mcp\\logs\\` (customizable via `BLACKDUCK_HOME`):\n\n- `black-duck-mcp.log` - Combined log (all levels)\n- `black-duck-mcp-error.log` - Error-only log\n\n## IP Allowlist\n\nThe following URLs and IP addresses must be accessible for the MCP server to function properly:\n\n| URL | IP Address |\n|-----|------------|\n| `repo.blackduck.com` | `34.149.5.115` |\n| `llm.core.blackduck.com` | `104.18.36.253` |\n\n> Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints\n\n\n## License\n\nThis project is licensed under the [MIT License](LICENSE).\n\n\n## Resources\n- [Documentation](https://documentation.blackduck.com/bundle/signal/page/topics/c_signal_overview.html)\n- [Black Duck Signal](https://www.blackduck.com/signal-ai-appsec.html)\n- [Contact Us](https://www.blackduck.com/signal-ai-appsec/early-access.html)\n- [Request SBOM](mailto:sbom_request@blackduck.com)\n",
  "bytes": 5627,
  "sha": "b2715de2812dc8912a6871dde9602a5ce512a3629ddbbbbe0faac1ff863c687c",
  "repo_slug": "blackducksoftware/mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_blackduck_mcp_server_79566d45/readme"
}