• IDENTIFIED
  • LISTED
  • DETAILED
  • HUMAN

How to audit project vulnerabilities with your AI

Connect Black Duck to your AI client to pull security data directly into your chat. You can then drill down into specific CVEs without leaving your workspace.

Ask AI about this page

Short answer

How can I audit project vulnerabilities with my AI?

Your AI uses Black Duck to find your projects, list their versions, and pull specific vulnerability data. You get deep technical details for CVEs by asking your agent to fetch them for a specific version. This breakdown shows you how to move from a high-level project search to specific vulnerability details.

Where every issue lands.

Security triage outcomes

The AI organizes the data it finds into these four categories.

IDENTIFIED

Project and version lists

The AI finds your specific repositories and the versions currently under review. You get a clear view of what is being scanned.

LISTED

Vulnerability summaries

Your agent pulls a list of all known vulnerabilities for a selected version. This gives you the scope of the security risk.

DETAILED

Deep CVE technicals

The AI retrieves the specific technical details for individual CVEs. You get the exact data needed to understand the threat.

HUMAN

Manual remediation

The AI provides the data, but you decide how to patch the code. You handle the actual fixes in your development environment.

The workflow

What your AI does when the data arrives.

The AI follows a logical path from finding your code to extracting specific security flaws.

  1. Locate your code

    The AI searches your Black Duck environment to find the relevant projects you want to inspect.

    search_projects

  2. Select a version

    Once the project is found, the AI identifies all available versions of that project.

    list_project_versions

  3. Scan for flaws

    The AI pulls a list of all vulnerabilities associated with the version you specified.

    list_vulnerabilities

  4. Extract CVE data

    The AI grabs the deep technical specifics for a particular vulnerability to help you understand the impact.

    get_vulnerability_details

Try it

Copy these to start.

Use these prompts to begin your audit.

Starting points

Swap out the project names and version numbers with your actual Black Duck data.

Black Duck (Synopsys) Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_eTCyoXvtTgK3EkQ58yH9XVC5hI8lZOw5G2qwRxyC/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Black Duck (Synopsys) capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "black-duck-synopsys-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_eTCyoXvtTgK3EkQ58yH9XVC5hI8lZOw5G2qwRxyC/mcp"
    }
  }
}
Copy into chat04

  • Find the project named 'payment-gateway' in Black Duck.

  • List all versions for the 'auth-service' project.

  • Show me all vulnerabilities for 'frontend-app' version 2.4.1.

  • Get the technical details for the CVE found in the 'api-server' version 1.0.5.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Black Duck once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start asking your AI about your project security.

Connect Black Duck to your AI

FAQ

How this task behaves

  • 01

    Can the AI fix the vulnerabilities for me?

    No. The AI only retrieves the technical details and lists of vulnerabilities. You must perform the actual code changes and patches yourself.

  • 02

    Can the AI delete a project from Black Duck?

    No. This MCP only has permissions to read and retrieve data. It cannot modify or delete any of your project information.

  • 03

    Does the AI see all my Black Duck data?

    The AI only sees the data it retrieves through the specific tools you trigger via your prompts.

  • 04

    Can I ask about vulnerabilities in a specific version?

    Yes. You can specify a project and a version to get a targeted list of vulnerabilities.

  • 05

    How does the AI find my projects?

    The AI uses the search tool to look through your Black Duck project list based on the names you provide.

  • More questions about Black Duck? See everything the Black Duck Connector can do

Connect Black Duck (Synopsys) to Claude, Cursor, ChatGPT & more