blackduck-sca-mcp 0.9.2

A agentic tool for handling and orchestrating Black Duck SCA products.

Black Duck SCA — MCP Server

Connect your AI coding assistant to the Black Duck Software Composition Analysis (SCA) products. The MCP server exposes your Black Duck SCA instance as a set of tools that any MCP-compatible AI harness can call to perform actions such as: investigate your software's security posture and vulnerabilities, triage findings, generate vulnerability reports and SBOMs.

Black Duck Website

Capabilities

These are the MCP tool areas currently available.

Area	Available Features	Related Tool Names
Dashboard	View instance-wide security posture, activity trends, and vulnerability breakdowns	get_dashboard_summary
Projects	Find projects and versions, inspect BOM contents, and review project-level vulnerabilities	search_projects_versions fetch_project_components fetch_project_vulnerabilities
Components	Search components across projects and see where specific versions are used	search_components
Vulnerabilities	Search the global vulnerability dataset and update remediation/triage status	search_vulnerabilities update_vulnerability_remediation
Policies	Check policy violation status and compliance at project version level	fetch_policy_violation_status
Scanning	Run scans for source, binary, container, and SBOM inputs; check scan status and results; match code snippets	scan search_scans get_scan_status match_code_snippet
Reports	Generate SBOM, VEX/CSAF, and Notices reports	create_report
Connectivity	Validate backend connectivity and credential health	check_connectivity

You can always check the full list of available tools by asking your AI assistant to list them, e.g. "What Black Duck SCA tools do you have access to and what are their functions?"

Prerequisites

• Black Duck SCA instance with a user account and API token
• Python 3.13 or later+
• uv — Python package manager
• Java 11+ (optional) — required only for source scanning via Detect

Installation

Claude Code

claude mcp add blackduck-bdsca-mcp \
  --env BLACKDUCK_BDSCA_URL=https://<your-instance-url> \
  --env BLACKDUCK_BDSCA_TOKEN=<api-token> \
  -- uvx \
  --managed-python --python 3.13 \
  --from 'blackduck-sca-mcp' bdsca \
  --transport stdio

Claude Desktop/Cowork

Add via UI and make sure the config file has similar values afterward.

{
    "managedMcpServers": [
    {
      "name": "blackduck-bdsca-mcp",
      "source": "user",
      "transport": "stdio",
      "command": "/bin/uvx",
      "args": [
        "--managed-python",
        "--python", "3.13",
        "--from", "blackduck-sca-mcp", "bdsca",
        "--transport", "stdio"
      ],
      "env": {
        "BLACKDUCK_BDSCA_URL": "https://<your-instance-url>",
        "BLACKDUCK_BDSCA_TOKEN": "<api-token>"
      }
    }
  ]
}

VS Code

Add to .vscode/mcp.json in your project:

{
  "servers": {
    "blackduck-bdsca-mcp": {
      "command": "uvx",
      "args": [
        "--managed-python",
        "--python", "3.13",
        "--from", "blackduck-sca-mcp", "bdsca",
        "--transport", "stdio"
      ],
      "env": {
        "BLACKDUCK_BDSCA_URL": "https://<your-instance-url>",
        "BLACKDUCK_BDSCA_TOKEN": "<api-token>"
      }
    }
  }
}

Copilot CLI

Copilot CLI currently does not implement the full
MCP spec, it is missing handling of MCP resources. To work around that, we can expose those resources as tools by specifying the BLACKDUCK_MCP_ENABLE_RESOURCES_AS_TOOLS=true environment variable.

copilot mcp add blackduck-bdsca-mcp \
  --env BLACKDUCK_BDSCA_URL=https://<your-instance-url> \
  --env BLACKDUCK_BDSCA_TOKEN=<api-token> \
  --env BLACKDUCK_MCP_ENABLE_RESOURCES_AS_TOOLS=true \
  -- uvx \
  --managed-python --python 3.13 \
  --from 'blackduck-sca-mcp' bdsca \ 
  --transport stdio

{
  "servers": {
    "blackduck-bdsca-mcp": {
      "command": "uvx",
      "args": [
        "--managed-python",
        "--python", "3.13",
        "--from", "blackduck-sca-mcp", "bdsca",
        "--transport", "stdio"
      ],
      "env": {
        "BLACKDUCK_BDSCA_URL": "https://<your-instance-url>",
        "BLACKDUCK_BDSCA_TOKEN": "<api-token>"
      }
    }
  }
}

Roo Code

Use the same .vscode/mcp.json configuration as GitHub Copilot above.

SSL/TLS

If your instance uses a self-signed certificate, either add it to your system's trusted certificate store or set below for the MCP to allow it to connect:

export BLACKDUCK_BDSCA_SSL_VERIFY=false

Security

API tokens inherit the full permissions of the associated user account. If you provide a token with write access, the AI assistant can modify data in your Black Duck SCA instance — including updating vulnerability remediation status and policy overrides.

We recommend creating a dedicated service account with the minimum permissions required for your use case. See the Role and Permission Matrix for details.

Environment Variables

Available environment variables for configuring the MCP server:

Variable	Default	Description
BLACKDUCK_BDSCA_URL	https://localhost	Base URL of the Black Duck BDSCA instance
BLACKDUCK_BDSCA_TOKEN	(required)	API bearer token for BDSCA authentication
BLACKDUCK_BDSCA_SSL_VERIFY	true	Whether to verify SSL/TLS certificates for BDSCA connections
BLACKDUCK_BDSCA_LOG_LEVEL	INFO	Logging level: DEBUG, INFO, WARNING, ERROR, CRITICAL
BLACKDUCK_BDSCA_LOG_FORMAT	colored	Log format: colored, json, simple
BLACKDUCK_BDSCA_LOG_FILE	(none)	Path to a log file (written in addition to stderr)

All three logging variables can also be set via CLI flags for the MCP command (--log-level, --log-format, --log-file), which take precedence over environment variables.

Support

• Black Duck Website
• Community Portal
• Email