Black Duck Signal and GitHub Copilot

Quickstart

Black Duck Signal can work with AI assistants like Copilot to secure your code, including code generated by agentic workflows. This page describes how to register the Black Duck MCP server with Visual Studio Code and begin scanning, using Copilot and Black Duck.

Prerequisites:

• Node.js 24 or higher
• Visual Studio Code
• GitHub Copilot plugin

If you don’t have GitHub Copilot in Visual Studio Code, use the Extensions Marketplace to install it. For more details, see the official GitHub Copilot - Getting Started.

Add the Black Duck MCP Server on GitHub Copilot and get started

1. In Visual Studio Code, open the Command Palette (Command + Shift + P)
2. Search for: “MCP: Add Server”. Select it.
3. Select Command (stdio) as MCP server type.
4. When you see "Enter Command," enter npx @black-duck/mcp-server@latest. Press enter.
5. When you see "Enter server ID," give the server a name. We suggest black-duck.
6. Choose whether the MCP server is available globally or only in the current workspace.

7. In the mcp.json file, add the following configuration.

   {
     "servers": {
       "black-duck": {
         "type": "stdio",
         "command": "npx",
          "args": ["@black-duck/mcp-server@latest"],
         "env" : {
           "BLACKDUCK_MCP_GATEWAY_KEY": "YOUR_LLM_API_KEY"
           "BLACKDUCK_MCP_LOG_LEVEL": "info" 
       }
       }
     }
   }
                                   

   ‌About this code example:

   • Replace the API key placeholder with your API key.

   • If you see a link that says "Start" after you have finished editing the file, click it.

   • When troubleshooting, set BLACKDUCK_MCP_LOG_LEVEL to "debug."

Test your setup

1. Open a new chat window
   • Shift + Command + I on MacOS or Linux
   • Shift + Alt + I on Windows
2. Ask Copilot to scan some of your code using Black Duck.