# Black Duck (Synopsys) MCP for AI Agents AI Agent Connect

> Black Duck (Synopsys) lets you pull open source security data and license compliance info directly into your AI agent. You can query project versions, check for CVEs, monitor BOM statuses, and audit security policies without leaving your workspace. It connects your Black Duck instance to your workflow so you can manage software supply chain risks faster.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_eTCyoXvtTgK3EkQ58yH9XVC5hI8lZOw5G2qwRxyC/ai-agent-connect
- **Tags:** open-source-security, vulnerability-scanning, license-compliance, software-supply-chain, cve-tracking, risk-management

## Description

The Black Duck (Synopsys) MCP lets you pull open source security data and license compliance info directly into your AI agent. You spend way too much time jumping between browser tabs to figure out if a new library version is safe or if a project's Bill of Materials is actually up to date. It's a constant cycle of searching for CVEs and trying to keep your license compliance in line across dozens of different repositories. This Connector changes that by putting your Black Duck instance right where you're already working. Instead of manual exports, you just ask your agent to find the vulnerabilities in a specific project or check if a security policy is being followed. You get answers in seconds, whether you're looking for a specific project's history or trying to audit user access. It's one of the ways Vinkius helps you move from manual data hunting to active security management. You stop worrying about whether your data is current and start spending your time actually fixing the risks your agent finds.

## Tools

### list_project_versions
See every version of a specific project listed in your instance. This helps you track the lifecycle of your software assets.

### list_projects
Get a complete list of all projects in your Black Duck account. Use this to get a high-level view of your entire inventory.

### list_code_locations
See every location where your code was scanned. This helps you verify coverage across different repositories.

### list_users
See every user profile currently registered in your Black Duck instance. This is useful for managing access and permissions.

### search_projects
Find a specific project by name when you have a large inventory. This saves you from scrolling through endless project lists.

### get_bom_status
Check if the Bill of Materials calculation is finished for a specific project version. Use this to ensure compliance data is ready.

### get_project
Pull the full metadata and details for a specific project. It provides a quick way to see all project specs in one go.

### list_vulnerabilities
Get a list of all CVEs and issues for a project version. This is your primary way to spot security risks quickly.

### get_vulnerability_details
See the specific details and severity for a single CVE. Use this to understand the impact of a specific security flaw.

### list_policy_rules
View all the security policy rules your organization has active. It makes auditing your security posture much faster.

## Prompt Examples

**Prompt:** 
```
Which projects have critical vulnerabilities right now?
```

**Response:** 
```
I've scanned your Black Duck instance and identified the following projects with critical security issues:

| Project Name | Version | CVE Count | Severity |
| :--- | :--- | :--- | :--- |
| **Payment Gateway** | v2.1.0 | 3 | Critical |
| **Auth Service** | v1.0.4 | 1 | High |
| **User Dashboard** | v3.0.1 | 2 | Critical |

Would you like me to pull the specific details for the Payment Gateway vulnerabilities?
```

**Prompt:** 
```
Is the BOM for the 'Payment Gateway' project ready?
```

**Response:** 
```
I checked the status for you. 

**Project:** Payment Gateway
**Version:** v2.1.0
**BOM Status:** `UP_TO_DATE` 

The Bill of Materials is fully calculated and synchronized with your compliance policies.
```

**Prompt:** 
```
List all the security policies we have.
```

**Response:** 
```
Here are the current security policy rules defined in your Black Duck instance:

*   **High Severity Alert:** Notify security team on all Critical CVEs.
*   **License Policy:** Block GPLv3 licenses in production builds.
*   **Scan Frequency:** Require weekly scans for all active projects.
*   **BOM Requirement:** All projects must have an active BOM status before deployment.
```

## Capabilities

### Pull project metadata
Get deep details on specific software projects and their versions.

### Find CVEs
Identify known vulnerabilities for any project version in your inventory.

### Check BOM status
Verify if the Bill of Materials is calculated and ready for compliance.

### Audit security policies
List and review the rules governing your organization's security.

### Track scan history
See where code was scanned and how often it's been checked.

### Manage user access
View profiles and control who has access to your Black Duck data.

## Use Cases

### Emergency CVE Response
A security engineer gets an alert and asks the agent to use list_vulnerabilities to see how many projects are affected.

### Pre-deployment Check
A developer asks the agent to check the BOM status for a new version to ensure it's ready for production.

### Quarterly Audit
A compliance officer asks the agent to list all security policy rules and summarize the current project list.

### Inventory Cleanup
A lead dev asks the agent to search_projects for all legacy apps to decide what to decommission.

## Benefits

- Faster vulnerability response: Use list_vulnerabilities to spot critical CVEs in seconds instead of hunting through the Black Duck dashboard.
- Automated compliance checks: Use get_bom_status to verify that your Bill of Materials is current without manual status checks.
- Instant project oversight: Use list_projects and get_project to get a full inventory of your software assets instantly.
- Simplified policy auditing: Use list_policy_rules to quickly review organization-wide security rules during audits.
- Better developer visibility: Developers can use list_project_versions to see exactly what's available without leaving their flow.
- Streamlined access management: Use list_users to keep track of who has access to your security data for better governance.

## How It Works

The bottom line is you get a direct line from your AI agent to your security data without the manual overhead.

1. Subscribe to the Black Duck MCP on Vinkius.
2. Input your Black Duck Instance URL and API Token.
3. Ask your AI client to check for vulnerabilities or list projects.

## Frequently Asked Questions

**How does the Black Duck (Synopsys) MCP help with CVE tracking?**
It lets your AI agent query your specific Black Duck instance to find vulnerabilities instantly. Instead of searching a dashboard, you can just ask your agent to list CVEs for a specific project or version.

**Can I use the Black Duck (Synopsys) MCP to check license compliance?**
Yes. You can use it to check the status of your Bill of Materials (BOM) to ensure your software stays compliant with your organization's rules.

**Who can use the Black Duck (Synopsys) MCP in their workflow?**
It's designed for security engineers auditing risks, developers checking library safety, and compliance officers who need to pull status reports quickly.

**Does the Black Duck (Synopsys) MCP support searching for specific projects?**
Yes, it includes a tool to search your project inventory by name, which is helpful if you have a large number of projects to manage.

**How do I get my project data into my AI agent using Black Duck (Synopsys)?**
By connecting this Connector to your AI client, your agent gains the ability to read your project metadata, vulnerability lists, and policy rules directly.

**Can the Black Duck (Synopsys) MCP show me who has access to my data?**
Yes, it can list all users registered in your Black Duck instance, making it easier to audit and manage access controls.

**Can I check for critical vulnerabilities in a specific project version?**
Yes! Use the `list_vulnerabilities` tool with the Project and Version IDs. Your agent will fetch the list of components with known security flaws and their severity levels.

**How do I know if my Black Duck scan is finished?**
Simply ask the agent to `get_bom_status` for the specific project version. It will return the current calculation status, showing if the BOM is 'Up to date' or still processing.

**What happens if I trigger API rate limits?**
Black Duck limits connections to 100 requests per 10 seconds or 10,000 per 30 minutes. If you exceed this sustained load protection, you will temporarily receive a HTTP 429 error code restricting your IP for 15 minutes.