All stories
Black Duck Signal Agentic Fix Ecosystem Developing

Black Duck's new Claude Code plug-in aims to fix vulnerabilities without skipping human review

Signal Agentic Fix pairs security scanners with a coding agent and a review gate; Black Duck's launch sources disagree with its product page on the early-access date.

By AITrending2 min read
Sources (3)

Why now The October 27 announcement describes a Claude Code early-access route for Coverity users, giving developers a concrete integration to assess while broader pipeline support remains planned.
Black Duck's video cover places an AI symbol and a human approval symbol over a Claude Code security-fix example.
Company-published overview video cover from Black Duck's launch blog. The illustrative approval graphic is promotional material, not an AITrending test of the plug-in. Source: Black Duck

Black Duck announced Signal Agentic Fix on October 27, pitching a security collaborator that works alongside Claude Code to scan code, prioritize vulnerabilities, generate repairs and check the result before a person approves the change. Its launch blog describes the initial early-access integration as a Claude Code plug-in for Coverity users.

The workflow separates several jobs often collapsed into a prompt asking an assistant to make code secure. Black Duck says its deterministic static analysis and software composition analysis engines find issues in application code and dependencies. AI then helps assess severity, reachability and exploitability. In the coding-agent integration, the findings and repair guidance go back to the developer’s agent, which implements the change; Signal then scans again to validate it.

The company also describes a pipeline version that uses a configured language model and submits fixes as source-control pull requests. That route and further coding-agent integrations are planned for the coming weeks, rather than established as generally available today. Teams can configure remediation policies, validation rules and optional tests. Black Duck says a developer or team must approve changes before they enter the codebase.

Availability needs checking. The October 27 press release says the Claude Code version is available in early access today, and the blog narrows that offer to Coverity users. However, the Signal product page inspected for this report still labels Agentic Fix early access for November 1. The sources do not resolve that discrepancy, and AITrending has not verified customer access. The public launch material also leaves pricing, installation commands and supported Claude Code versions unspecified.

The concrete news is a security vendor putting scan-and-fix work inside the coding-agent loop with an explicit human review gate. Claims about faster remediation and reliable fixes remain Black Duck’s pitch. Re-scanning and configured tests add checks; they do not prove that every generated patch preserves application behavior or removes every vulnerability.

Related reading