Black Duck’s Coverity gets better at AI-era triage

What changed in Black Duck Coverity, and which update matters most for your DevSecOps team?

Black Duck updated Coverity with AI-linked scanning, faster triage, and broader language coverage.

1. MCP server for AI coding agents

Black Duck’s Black Duck added a Model Context Protocol server to Coverity, letting AI coding agents trigger local security and code-quality scans inside the development flow. The practical value is simple: the scan happens where the code is being written, so developers get feedback before the change spreads farther.

The company says the integration can work with the large language model a team already prefers, which matters for groups standardizing on different AI tools. That makes the feature less about a single assistant and more about wiring Coverity into the AI workflow teams already use.

• Local scans from AI agents
• Security and quality findings in context
• Model choice is not locked to one vendor

2. Security impact lens for compliance sorting

Coverity now includes a security impact lens that helps teams sort and filter issues by priority. In the article’s example, that is meant to make it easier to align with compliance demands such as the European Union’s Cyber Resilience Act, which can require faster reporting and tighter issue handling.

This is less about finding more bugs and more about deciding which bugs deserve attention first. For teams buried under scan output, that distinction can save time and reduce the chance that a high-risk issue sits in the queue behind lower-value noise.

• Filter by security priority
• Support for compliance-driven triage
• Useful when issue volume is high

3. IDOR checker for JavaScript and TypeScript

Black Duck also added a checker for Insecure Direct Object Reference, or IDOR, vulnerabilities in JavaScript and TypeScript code. IDOR flaws are a common application security problem because they can expose data or actions that should have stayed behind access controls.

For teams shipping web apps, this is a focused addition rather than a broad platform change. It targets a specific weakness in two widely used languages, which can help security teams catch a class of issue that often slips through general-purpose review.

• Targets JavaScript
• Targets TypeScript
• Finds IDOR-specific flaws

4. AI-assisted triage for C and C++ scans

Coverity now includes AI-assisted issue triage tuned for C and C++ scans, where false positives can pile up quickly. That matters because teams often spend too much time sorting alerts before they can fix the code that actually needs attention.

The update is meant to speed up review, not replace it. In practice, the value is in reducing the manual work of separating likely real defects from findings that look urgent but are not worth immediate action.

5. Rust 1.92 support

Black Duck also added support for Rust 1.92, which extends Coverity’s reach into a language that continues to gain ground in security-sensitive development. For teams using Rust in production, version support matters because static analysis tools need to keep pace with the compiler and language features developers actually ship.

This update is the least flashy of the group, but it is often the one that decides whether a tool stays in the build pipeline. If your codebase includes Rust, version compatibility is not a nice-to-have, it is what keeps scanning from breaking when the toolchain moves forward.

• Rust 1.92 compatibility
• Useful for mixed-language codebases
• Helps keep scanning current with the toolchain

How to decide

If your team is already using AI coding agents, the MCP server is the most direct upgrade because it puts scans inside the workflow. If your main pain is backlog management, the security impact lens and AI-assisted triage will matter more, since both focus on ranking and reducing noise.

Teams building in JavaScript, TypeScript, C, C++, or Rust should look at the language-specific additions first. The best fit depends on whether your bottleneck is AI integration, compliance sorting, false positives, or language coverage.