{"name":"io.github.inspicere/mcp-defectdojo","slug":"inspicere-mcp-defectdojo","title":"DefectDojo","description":"MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding","url":"https://mcp.market/server/inspicere-mcp-defectdojo","rating":null,"grade":"B","score":72,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":14,"stars":0,"forks":0,"downloads_week":33,"last_push_at":"2026-06-14T00:47:14.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/inspicere/mcp-defectdojo","website":null,"version":"3.3.2","remotes":[],"packages":[{"registryType":"pypi","registryBaseUrl":"https://pypi.org","identifier":"mcp-defectdojo","version":"3.3.2","runtimeHint":"uvx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)","isRequired":true,"name":"DEFECTDOJO_URL"},{"description":"API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.","isRequired":true,"isSecret":true,"name":"DEFECTDOJO_API_KEY"},{"description":"Optional read-only API key (used for GET requests in dual-key mode)","isSecret":true,"name":"DEFECTDOJO_READ_API_KEY"},{"description":"Optional write API key (used for POST/PATCH in dual-key mode)","isSecret":true,"name":"DEFECTDOJO_WRITE_API_KEY"},{"description":"Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)","isSecret":true,"name":"MCP_AUTH_TOKEN"},{"description":"HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'","isSecret":true,"name":"AUDIT_HMAC_KEY"}]}],"tools":[{"name":"add_finding_note","description":"Add a note to a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), entry (note text), private (default false). Returns JSON with created note — the `entry` field is F-002 wrapped (`{\"value\": ..., \"_warning\": \"untrusted-content: ...\"}`) since Phase 12; disable via `UNTRUSTED_CONTENT_WRAPPING=off` (see DEC-027).","write_action":false,"price_micros":0,"input_schema":null},{"name":"add_finding_tags","description":"Add tags to a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), tags (non-empty list of strings, each <= 200 chars). Returns JSON with tags array.","write_action":false,"price_micros":0,"input_schema":null},{"name":"close_finding","description":"Close a finding with a reason. Requires write scope. Rate-limited. Args: finding_id (> 0), reason (mitigated/false_positive/out_of_scope/duplicate), note (optional closure note). Returns JSON with updated finding.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_engagement","description":"Create a new engagement. Requires write scope. Rate-limited. Args: product_id (> 0), name, target_start (YYYY-MM-DD), target_end (YYYY-MM-DD). Returns JSON with created engagement.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_finding","description":"Create a new finding. Requires write scope. Rate-limited. Args: test_id (> 0), title, severity (Critical/High/Medium/Low/Info), description, active (default true), verified (default false). Returns JSON with created finding.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_product","description":"Create a new product. Requires write scope. Rate-limited. Args: name, description, prod_type_id (must be > 0). Returns JSON with created product.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_test","description":"Create a new test. Requires write scope. Rate-limited. Args: engagement_id (> 0), test_type_id (> 0), target_start (YYYY-MM-DD), target_end (YYYY-MM-DD). Returns JSON with created test.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_engagement","description":"Get a single engagement by ID. Args: engagement_id (must be > 0). Returns JSON with engagement fields.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_finding","description":"Get a single finding by ID. Args: finding_id (must be > 0). Returns JSON with finding fields.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_product","description":"Get a single product by ID. Args: product_id (must be > 0). Returns JSON with id, name, description, prod_type fields.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_test","description":"Get a single test by ID. Args: test_id (must be > 0). Returns JSON with test fields.","write_action":false,"price_micros":0,"input_schema":null},{"name":"health_check","description":"Check connectivity to the DefectDojo instance. Returns JSON with status 'ok' or 'unhealthy' and a message.","write_action":false,"price_micros":0,"input_schema":null},{"name":"import_scan","description":"Import a scan report into DefectDojo. Requires write scope. Rate-limited.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_engagements","description":"List engagements for a product. Args: product_id (> 0), limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_finding_notes","description":"List notes for a finding. Args: finding_id (> 0). Returns universal envelope `{\"items\": [...], \"pagination\": {...}}` with note `entry` F-002 wrapped.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_findings","description":"List findings with optional filters. Args: test_id, product_id, engagement_id (all optional, > 0); severity (Critical/High/Medium/Low/Info); active, verified, duplicate, false_p, out_of_scope, is_mitigated, risk_accepted, outside_of_sla (all optional booleans); tags (optional list); component_name, title (optional strings); limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_product_types","description":"List product types in DefectDojo. Use this to find valid prod_type_id values for create_product. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_products","description":"List products in DefectDojo. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_test_types","description":"List test types in DefectDojo. Use this to find valid test_type_id values for create_test. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_tests","description":"List tests for an engagement. Args: engagement_id (> 0), limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"reimport_scan","description":"Re-import a scan report into an existing test in DefectDojo. Requires write scope. Rate-limited.","write_action":false,"price_micros":0,"input_schema":null},{"name":"remove_finding_tags","description":"Remove tags from a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), tags (non-empty list of tag strings to remove). Returns JSON with tags array.","write_action":true,"price_micros":0,"input_schema":null},{"name":"reopen_finding","description":"Reopen a previously mitigated finding. Requires engagement_mgmt permission — reopening signals remediation failure and is gated above finding_mgmt. Rate-limited. Args: finding_id (> 0), note (optional reason for reopening). Returns JSON with updated finding.","write_action":false,"price_micros":0,"input_schema":null},{"name":"update_finding","description":"Update an existing finding. Requires write scope. Rate-limited. Args: finding_id (> 0), plus optional: title, severity (Critical/High/Medium/Low/Info), description, active, verified, false_p, duplicate, out_of_scope, is_mitigated. At least one field required. Returns JSON with updated finding. State-transition gate (F-008/F-018): mitigated→unmitigated cascades (active=true, explicit is_mitigated=f","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":72,"grade":"B","scanned_at":"2026-09-27T17:06:03.171Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-27T17:06:03.244Z","components":{"code":{"score":25,"max":25,"notes":["8 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":8,"max":15,"notes":["last push 106 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"mcp-defectdojo","version":"3.3.2","found":true,"weeklyDownloads":33,"license":"MIT","dependencyCount":5,"publishedAt":"2026-05-28T01:27:40.870206Z","repositoryUrl":"https://github.com/inspicere/mcp-defectdojo"}],"repo":{"found":true,"owner":"inspicere","repo":"mcp-defectdojo","archived":false,"pushedAt":"2026-06-14T00:47:14Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/10132158?v=4","ownerCreatedAt":"2014-12-09T16:43:37Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/10132158?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":33,"license":"MIT","lastPushAt":"2026-06-14T00:47:14.000Z","score":14}}}},"grade_history":[],"reviews":[]}