Black Duck Security Scanner

Black Duck Security Scanner runs locally from a Node.js package published to the npm registry: @black-duck/mcp-server version 1.1.8. It speaks MCP over stdio, so the client starts it as a program and talks to it through standard input and output. It needs Node.js; clients usually start it with npx — the usual command is npx -y @black-duck/mcp-server@1.1.8.

Black Duck Security Scanner runs locally from an MCP Bundle: a single downloadable archive holding a local server and a manifest that describes it: https://github.com/blackducksoftware/mcp-server/releases/download/v1.1.8/black-duck-mcp-1.1.8.mcpb version 1.1.8. It speaks MCP over stdio, so the client starts it as a program and talks to it through standard input and output. It needs a client that installs MCP Bundles; the file is opened in, or added to, that client.

In the mcpServers JSON format that many desktop and editor MCP clients read, the entry looks like this (placeholders in angle brackets):

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@black-duck/mcp-server@1.1.8"
      ]
    }
  }
}

Derived from the registry entry, not tested here. What the server does, and on what terms, is set by its publisher; check its repository or website before giving it access to your accounts or files. How to add an MCP server to an assistant · Before you connect