Can AI agents automate Black Duck Signal?

Black Duck Signal is automatable today through the official Black Duck MCP server. This record is Black Duck Signal agentic AppSec as packaged in @black-duck/mcp-server and blackducksoftware/mcp-server. It is not classic Black Duck SCA/Hub, Checkmarx One, Snyk, or Semgrep. Opened vendor MCP and product pages do not show that this MCP is the Black Duck SCA/Hub API, and they do not publish a public Signal REST API, so API presence stays unknown. The MCP runs locally over stdio as `npx -y @black-duck/mcp-server` and requires BLACKDUCK_MCP_GATEWAY_KEY plus a Signal license. npm still points that license requirement at the Signal Early Access Program page. Node.js 24 or newer is required. Documented tools are run_changes_security_scan (git incremental; all-uncommitted or reference-branch) and run_security_scan (file or directory paths). Both return a SARIF path, issue counts, and analysis guidance. Outbound HTTPS to repo.blackduck.com and llm.core.blackduck.com on port 443 is required. The opened pages do not establish an official Signal CLI, webhooks, or language SDK. iPaaS connector catalogs were not opened. Computer-use viability is unassessed. MCP scores 6 because it is a maintained official server whose public surface is two local scan tools behind a license gate, not a hosted production MCP with tenant issue management.

Best path today: mcp · Overall automatability: 6/10