Command line clients

Black Duck Documentation
Version
2026.4

For scripting in the command line, users have a choice between the original Detect client (built by the Black Duck team for Black Duck SCA) and the Bridge CLI client.

Detect client

Black Duck Detect is a scan client that analyzes code in your projects and associated folders to perform compositional analysis and find vulnerabilities.

It can be configured to send scan results to Black Duck, which generates risk analysis when identifying open-source components, licenses, and security vulnerabilities.

How Detect works:

  1. Uses the project's package manager to derive the hierarchy of dependencies.

  2. Runs the Black Duck signature scanner on the project. This might identify additional dependencies not known to the package manager.

  3. Uploads both sets of results (dependency details) to Black Duck, which creates the Bill Of Materials (BOM) for the project/version.

  4. You can view the output and analysis results in Black Duck SCA.

Detect consolidates the functionality of Black Duck, package managers, and continuous integration plugin tools to perform the following tasks:

  • Discover open-source components in your code.

  • Map components to known security vulnerabilities.

  • Identify license compliance and component quality risks.

  • Set and enforce open-source use and security policies.

  • Integrate open-source management into your DevOps environment.

  • Monitor and alert users when new security threats are reported.

  • Calculate security vulnerability risk in your code.

  • Produce reports of the open-source analysis findings.

  • Provide malware information if identified.

Note: Some scan types require specific feature licenses to execute. Contact your Black Duck representative for further information.

Bridge CLI client

Bridge is useful when you want a unified CLI for all the security tools offered by Black Duck Software: Polaris, Coverity Connect, Black Duck SCA, Software Risk Manager.

Bridge does all the following:

  • SAST and SCA scanning

  • Scan in synchronous or asynchronous (non-blocking) mode

  • Scan whenever new code is merged to a branch

  • Scan whenever a pull request is created/updated

  • Decorate PRs with comments

  • Create Fix PRs (Black Duck SCA only)

  • Generates a SARIF file

  • Post results to SCM (GitHub advanced security)

  • Post results to any supported server (see the list of products above).

For more information see, Bridge documentation.

Note: Bridge can do any of the above in an air gapped environment. See the individual tool pages for more information.