# Black Duck Security Scanner > AI-powered security scanning using Black Duck Signal for vulnerability detection. - name: com.blackduck/mcp-server - version: 1.1.8 - connection class: L0 (run_local_package) - trust: 79/100 - quality: –/100 (not scored) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/com.blackduck%2Fmcp-server - tools: https://api.protogrid.dev/v1/servers/com.blackduck%2Fmcp-server/tools **Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it. ## Connection (mcpServers) ```json { "mcpServers": { "blackduck": { "command": "npx", "args": [ "-y", "@black-duck/mcp-server@1.1.8" ] } } } ``` ## Trust - hygiene: 100 - liveness: n/a - freshness: 65 - provenance: 75 - drivers: +repository +dns-namespace ~liveness-unmeasured ~updated-95d-ago - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality –/100 (not scored) Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package. ### protocol: n/a (weight 25) - n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only) ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: n/a (weight 30) - n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty) ### stability: n/a (weight 15) - n/a `stability.changes`, `stability.rug_pull`: tool list unknown ### dependencies: 33 (weight 15) - fail `deps.known_vulns`: 11 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-3pq3-5fj3-cg6v in axios@1.16.1 (direct, fixed in 1.20.0), GHSA-542g-h47m-68v8 in axios@1.16.1 (direct, fixed in 1.20.0), GHSA-c29m-xwm3-cm6r in axios@1.16.1 (direct, fixed in 1.20.0), ...; 14 more of lower severity or without a fix - fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.29.0 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later - pass `deps.resolvable`: @black-duck/mcp-server@1.1.8 resolved: 153 packages - tools: unknown - badge: [![protogrid quality](https://protogrid.dev/badge/com.blackduck/mcp-server.svg)](https://protogrid.dev/servers/com.blackduck/mcp-server) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes _No tool definition changes recorded._ ## Dependencies - npm @black-duck/mcp-server@1.1.8: resolved, 152 dependencies, MCP SDK @modelcontextprotocol/sdk 1.29.0 - GHSA-v5rq-49vh-5v5c (critical) in `` @simple-git/argv-parser@1.1.1 ``, indirect, fixed in `` 2.0.1 ``, advisory summary: "simple-git: \`VISUAL\` editor environment variable is omitted from unsafe editor detection" https://osv.dev/vulnerability/GHSA-v5rq-49vh-5v5c - GHSA-x6jw-m9v5-85vh (critical) in `` simple-git@3.36.0 ``, direct, fixed in `` 4.0.1 ``, advisory summary: "simple-git unsafe-operation guard does not block trailer command configuration" https://osv.dev/vulnerability/GHSA-x6jw-m9v5-85vh - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.29.0 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h - GHSA-3pq3-5fj3-cg6v (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls" https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v - GHSA-542g-h47m-68v8 (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization" https://osv.dev/vulnerability/GHSA-542g-h47m-68v8 - GHSA-c29m-xwm3-cm6r (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)" https://osv.dev/vulnerability/GHSA-c29m-xwm3-cm6r - GHSA-gcfj-64vw-6mp9 (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning" https://osv.dev/vulnerability/GHSA-gcfj-64vw-6mp9 - GHSA-m8m8-qj5v-23w3 (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection" https://osv.dev/vulnerability/GHSA-m8m8-qj5v-23w3 - GHSA-mghh-pgcx-3jjj (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location" https://osv.dev/vulnerability/GHSA-mghh-pgcx-3jjj - GHSA-x97p-jq2g-jp4f (high) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Prototype Pollution Gadget in axios toFormData Options" https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f - GHSA-858h-whjf-mvg5 (high) in `` simple-git@3.36.0 ``, direct, fixed in `` 4.0.0 ``, advisory summary: "simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\> command execution (residual of CVE-2026-28291)" https://osv.dev/vulnerability/GHSA-858h-whjf-mvg5 - GHSA-g4wm-2vf7-vfgr (high) in `` simple-git@3.36.0 ``, direct, fixed in `` 4.0.0 ``, advisory summary: "simple-git allows command execution through unblocked Git configuration includes" https://osv.dev/vulnerability/GHSA-g4wm-2vf7-vfgr - GHSA-42h9-826w-cgv3 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: Excessive recursion in formDataToJSON can cause denial of service" https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3 - GHSA-44g4-m2mj-wpvx (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: CIDR-form NO\_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges" https://osv.dev/vulnerability/GHSA-44g4-m2mj-wpvx - GHSA-4hqw-qxg8-jxx2 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders" https://osv.dev/vulnerability/GHSA-4hqw-qxg8-jxx2 - GHSA-7q8q-rj6j-mhjq (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: Nested axios option objects can consume polluted prototype values" https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq - GHSA-9fr6-4gfg-395g (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method" https://osv.dev/vulnerability/GHSA-9fr6-4gfg-395g - GHSA-f4gw-2p7v-4548 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: NO\_PROXY bypass for 0.0.0.0 local addresses in axios" https://osv.dev/vulnerability/GHSA-f4gw-2p7v-4548 - GHSA-hcpx-6fm6-wx23 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios form serializer maxDepth bypass via {} metatoken" https://osv.dev/vulnerability/GHSA-hcpx-6fm6-wx23 - GHSA-j8rh-479h-cp32 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Header Injection via Inherited headers After Minimal Interceptor" https://osv.dev/vulnerability/GHSA-j8rh-479h-cp32 - GHSA-jqh4-m9w3-8hp9 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: Fetch adapter \`ReadableStream\` uploads bypass \`maxBodyLength\`" https://osv.dev/vulnerability/GHSA-jqh4-m9w3-8hp9 - GHSA-mmx7-hfxf-jppx (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: Prototype pollution gadgets can alter axios request construction" https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx - GHSA-mwf2-3pr3-8698 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: HTTP/2 streamed uploads bypass \`maxBodyLength\`" https://osv.dev/vulnerability/GHSA-mwf2-3pr3-8698 - GHSA-pmv8-rq9r-6j72 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service" https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72 - GHSA-vh66-26gq-q6x8 (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.20.0 ``, advisory summary: "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests" https://osv.dev/vulnerability/GHSA-vh66-26gq-q6x8 - GHSA-xj6q-8x83-jv6g (moderate) in `` axios@1.16.1 ``, direct, fixed in `` 1.18.0 ``, advisory summary: "Axios: Prototype pollution auth subfields can inject Basic auth" https://osv.dev/vulnerability/GHSA-xj6q-8x83-jv6g Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. ## Remotes _none_ ## Packages - npm @black-duck/mcp-server@1.1.8 - mcpb https://github.com/blackducksoftware/mcp-server/releases/download/v1.1.8/black-duck-mcp-1.1.8.mcpb@1.1.8 ## Tools (0) _none observed_