Coding Assistants

Black Duck Signal

The Signal MCP Server facilitates the analysis of code from within a developer's coding assistant. The MCP server is distributed as an NPM package and is available from the public NPM registry via npx @black-duck/mcp-server@latest.

Contents

Environment Variables

The Signal MCP server uses environment variables for its configuration. The following are the most commonly used when adding the Signal MCP server to a coding assistant. For the complete list of configuration options, see the Signal Reference Guide.

Variable

Default value

Description
BLACKDUCK_MCP_GATEWAY_URL https://llm.core.blackduck.com/ LLM Gateway URL
BLACKDUCK_MCP_GATEWAY_KEY No default value. LLM Gateway API Key for enhanced AI analysis
BLACKDUCK_MCP_LOG_LEVEL info Signal Logging Level. Log level: error, warn, info, or debug
BLACKDUCK_HOME User's home directory Override the default .blackduck folder location
BLACKDUCK_MCP_TOOL_TIMEOUT 1800000 (30 min) Scan timeout in milliseconds

Black Duck MCP configuration

You can set these variables in your MCP client configuration:

 {
  "servers": {
    "black-duck": {
      "type": "stdio",
      "command": "npx",
      "args": ["@black-duck/mcp-server@latest"],
      "env" : {
        "BLACKDUCK_MCP_GATEWAY_KEY": "YOUR_LLM_API_KEY",
        "BLACKDUCK_MCP_LOG_LEVEL": "info" 
    }
    }
  }
}

Log location

All MCP logs are written to /Users/<username>/.blackduck/mcp/logs/ for Linux/mac and C:\Users\<Username>\AppData\Roaming\BlackDuck\mcp\logs\ (customizable via BLACKDUCK_HOME):

  • black-duck-mcp.log - Combined log (all levels)
  • black-duck-mcp-error.log - Error-only log

IP Allowlist

The following URLs and IP addresses must be accessible for the MCP server to function properly:

URL IP Address
repo.blackduck.com 34.149.5.115
llm.core.blackduck.com 104.18.36.253
Note:

Ensure your firewall allows outbound HTTPS (port 443) connections to these endpoints.

Signal with coding assistants

Black Duck Signal can work with different AI coding assistants like Copilot to secure your code, including code generated by agentic workflows. Select your preferred coding assistant: