How do I use blackduck-polaris-mcp-server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@blackduck-polaris-mcp-server trigger a SAST scan on the main branch" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

blackduck-polaris-mcp-server

by easygoingcoder

Overview Schema Related Servers Score Discussions

TypeScript

blackduck-polaris-mcp-server

npm version License: MIT Node.js

The most comprehensive MCP (Model Context Protocol) server for Black Duck Polaris. Trigger SAST/SCA/DAST scans, query findings, triage issues, generate and download reports (SBOM, SPDX, CycloneDX), manage policies, and more — all from your AI coding assistant.

Works With

Quick Start

Prerequisites

You need a Polaris API token. Generate one at Profile > Account > Access Tokens in your Polaris instance.

Claude Code

claude mcp add blackduck-polaris -e POLARIS_URL=https://your-instance.polaris.blackduck.com -e POLARIS_API_TOKEN=your-token -- npx blackduck-polaris-mcp-server

Claude Desktop (`claude_desktop_config.json`)

{
  "mcpServers": {
    "blackduck-polaris": {
      "command": "npx",
      "args": ["blackduck-polaris-mcp-server"],
      "env": {
        "POLARIS_URL": "https://your-instance.polaris.blackduck.com",
        "POLARIS_API_TOKEN": "your-token"
      }
    }
  }
}

VS Code (`.vscode/mcp.json`)

{
  "servers": {
    "blackduck-polaris": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "blackduck-polaris-mcp-server"],
      "env": {
        "POLARIS_URL": "https://your-instance.polaris.blackduck.com",
        "POLARIS_API_TOKEN": "your-token"
      }
    }
  }
}

Cursor (`.cursor/mcp.json` or `~/.cursor/mcp.json`)

{
  "mcpServers": {
    "blackduck-polaris": {
      "command": "npx",
      "args": ["-y", "blackduck-polaris-mcp-server"],
      "env": {
        "POLARIS_URL": "https://your-instance.polaris.blackduck.com",
        "POLARIS_API_TOKEN": "your-token"
      }
    }
  }
}

GitHub Copilot CLI

Option 1 — Config file (~/.copilot/mcp-config.json):

{
  "mcpServers": {
    "blackduck-polaris": {
      "type": "local",
      "command": "npx",
      "args": ["blackduck-polaris-mcp-server"],
      "env": {
        "POLARIS_URL": "https://your-instance.polaris.blackduck.com",
        "POLARIS_API_TOKEN": "your-token"
      }
    }
  }
}

Option 2 — Inline for a single session:

copilot --additional-mcp-config '{"blackduck-polaris":{"type":"local","command":"npx","args":["blackduck-polaris-mcp-server"],"env":{"POLARIS_URL":"https://your-instance.polaris.blackduck.com","POLARIS_API_TOKEN":"your-token"}}}'

OpenCode

Option 1 — Interactive: Run opencode mcp add and follow the prompts.

Option 2 — Config file (~/.config/opencode/opencode.json or opencode.json in project root):

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "blackduck-polaris": {
      "type": "local",
      "enabled": true,
      "command": ["npx", "-y", "blackduck-polaris-mcp-server"],
      "environment": {
        "POLARIS_URL": "https://your-instance.polaris.blackduck.com",
        "POLARIS_API_TOKEN": "your-token"
      }
    }
  }
}

Features — 66 Tools Across 10 Domains

Tool	Description
`polaris_list_portfolios`	List all portfolios
`polaris_list_applications`	List applications in a portfolio
`polaris_create_application`	Create new application
`polaris_update_application`	Update application
`polaris_delete_application`	Delete application
`polaris_list_projects`	List projects in an application
`polaris_create_project`	Create new project
`polaris_list_branches`	List branches in a project

Findings & Triage (10 tools)

Tool	Description
`polaris_list_issues`	Query issues with RSQL filter (severity, tool, CWE, status)
`polaris_get_issue`	Get full issue details
`polaris_get_triage_history`	View triage audit trail
`polaris_get_detection_history`	View detection change history
`polaris_triage_issue`	Dismiss, change severity, assign, update status
`polaris_list_occurrences`	List issue occurrences with filter
`polaris_get_occurrence_snippet`	Get vulnerable source code snippet
`polaris_get_remediation`	AI-assisted remediation guidance (Black Duck Assist)
`polaris_submit_remediation_feedback`	Feedback on AI remediation quality
`polaris_get_issue_counts`	Aggregated issue counts by severity/type

Scans / Test Management (8 tools)

Tool	Description
`polaris_trigger_scan`	Trigger SAST/SCA/DAST scan on a branch
`polaris_list_tests`	List scans with filter
`polaris_get_test`	Get scan status (QUEUED, RUNNING, COMPLETED, FAILED)
`polaris_cancel_test`	Cancel a running scan
`polaris_get_test_metrics`	Issue counts and metrics for a scan
`polaris_get_test_comments`	Get scan comments
`polaris_list_test_artifacts`	List scan artifacts
`polaris_create_test_artifact`	Upload artifact for external analysis

Reports (6 tools)

Tool	Description
`polaris_list_report_types`	List all report types
`polaris_generate_report`	Generate report (SBOM, SPDX, CycloneDX, executive summary, etc.)
`polaris_list_reports`	List generated reports
`polaris_get_report_status`	Check report generation status
`polaris_download_report`	Download completed report
`polaris_delete_report`	Delete a report

Supported report types: Developer Detail SCA, Developer Detail Static, Developer Detail Dynamic, Executive Summary, Issue Overview, Issue Summary, Security Audit, SBOM, SPDX v2.3, CycloneDX v1.4, CycloneDX v1.6, Standard Compliance, Standard Compliance Detail, Test Summary

Policies (7 tools)

Tool	Description
`polaris_list_issue_policies`	List issue policies
`polaris_create_issue_policy`	Create policy (build break, email, Jira ticket)
`polaris_update_issue_policy`	Update policy
`polaris_delete_issue_policy`	Delete policy
`polaris_list_scheduling_policies`	List test scheduling policies
`polaris_create_scheduling_policy`	Create automated scan schedule
`polaris_assign_policy`	Assign policy to project/application/branch

SCM / Repository Integration (7 tools)

Tool	Description
`polaris_list_repos`	List connected repositories
`polaris_get_repo`	Get repository details
`polaris_update_repo`	Update repository settings
`polaris_list_repo_branches`	List repository branches
`polaris_test_repo_connection`	Test SCM connectivity
`polaris_bulk_import_repos`	Bulk import repos from SCM
`polaris_list_scm_providers`	List supported SCM providers

Bug Tracking Integration (5 tools)

Tool	Description
`polaris_list_bugtracker_configs`	List Jira/Azure DevOps configurations
`polaris_create_bugtracker_config`	Create bug tracker integration
`polaris_update_bugtracker_config`	Update integration config
`polaris_export_issues_to_tracker`	Export issues to Jira/Azure DevOps
`polaris_test_jira_connection`	Test Jira connectivity

Audit (3 tools)

Tool	Description
`polaris_get_audit_logs`	Query audit logs (category, user, date range)
`polaris_export_audit_logs`	Export audit logs as CSV
`polaris_list_audit_categories`	List audit event categories

Identity & Access Management (9 tools)

Tool	Description
`polaris_list_users`	List organization users
`polaris_create_user`	Create user
`polaris_get_user`	Get user details
`polaris_update_user`	Update user role/details
`polaris_list_groups`	List groups
`polaris_create_group`	Create group
`polaris_get_current_user`	Get authenticated user info
`polaris_create_api_token`	Create API token
`polaris_create_service_account_token`	Create service account token

Notifications (3 tools)

Tool	Description
`polaris_get_notification_preferences`	Get org notification preferences
`polaris_update_notification_preferences`	Update notification preferences
`polaris_get_notification_subscriptions`	Get user event subscriptions

Example Workflows

Scan a branch and review findings

You: Trigger a SAST and SCA scan on the main branch of project X
AI: [calls polaris_trigger_scan] Scan triggered, test ID: abc-123

You: Check the scan status
AI: [calls polaris_get_test] Status: COMPLETED. 12 new issues found.

You: Show me the critical issues
AI: [calls polaris_list_issues with severity filter] Found 3 critical issues...

You: Show me the code for the first one
AI: [calls polaris_get_occurrence_snippet] Here's the vulnerable code at line 42...

You: Get remediation advice
AI: [calls polaris_get_remediation] Black Duck Assist suggests...

Generate a compliance report

You: Generate an SPDX report for application Y
AI: [calls polaris_generate_report] Report queued, ID: rpt-456

You: Is it ready?
AI: [calls polaris_get_report_status] Status: COMPLETED

You: Download it
AI: [calls polaris_download_report] Here's your SPDX v2.3 report...

Export issues to Jira

You: Show me all high-severity SAST issues
AI: [calls polaris_list_issues] Found 8 high-severity SAST issues

You: Export the first 3 to Jira
AI: [calls polaris_export_issues_to_tracker] 3 issues exported to Jira

Environment Variables

Variable	Required	Description
`POLARIS_URL`	Yes	Your Polaris instance URL (e.g., `https://polaris.blackduck.com`)
`POLARIS_API_TOKEN`	Yes	API token from Profile > Account > Access Tokens

Development

git clone https://github.com/your-username/blackduck-polaris-mcp-server.git
cd blackduck-polaris-mcp-server
npm install
npm run build
npm start

Testing with MCP Inspector

POLARIS_URL=https://... POLARIS_API_TOKEN=... npx @modelcontextprotocol/inspector node build/index.js

License

MIT

This server cannot be installed

license - not tested

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/easygoingcoder/blackduck-polaris-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

blackduck-polaris-mcp-server

Works With

Quick Start

Prerequisites

Claude Code

Claude Desktop (claude_desktop_config.json)

VS Code (.vscode/mcp.json)

Cursor (.cursor/mcp.json or ~/.cursor/mcp.json)

GitHub Copilot CLI

OpenCode

Features — 66 Tools Across 10 Domains

Portfolio Navigation (8 tools)

Findings & Triage (10 tools)

Scans / Test Management (8 tools)

Reports (6 tools)

Policies (7 tools)

SCM / Repository Integration (7 tools)

Bug Tracking Integration (5 tools)

Audit (3 tools)

Identity & Access Management (9 tools)

Notifications (3 tools)

Example Workflows

Scan a branch and review findings

Generate a compliance report

Export issues to Jira

Environment Variables

Development

Testing with MCP Inspector

License

Maintenance

Resources

Looking for Admin?

Latest Blog Posts

MCP directory API

Claude Desktop (`claude_desktop_config.json`)

VS Code (`.vscode/mcp.json`)

Cursor (`.cursor/mcp.json` or `~/.cursor/mcp.json`)