MCP.Market

DefectDojo MCP server

by inspicere·io.github.inspicere/mcp-defectdojo·v3.3.2
No reviews yet

MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding

B72/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
New

0 stars33 downloads/wk

Reviews

Write one

Nobody has reviewed DefectDojo yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

DefectDojo tools (24, 6 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • add_finding_note

    Add a note to a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), entry (note text), private (default false). Returns JSON with created note — the `entry` field is F-002 wrapped (`{"value": ..., "_warning": "untrusted-content: ..."}`) since Phase 12; disable via `UNTRUSTED_CONTENT_WRAPPING=off` (see DEC-027).

  • add_finding_tags

    Add tags to a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), tags (non-empty list of strings, each <= 200 chars). Returns JSON with tags array.

  • close_finding

    Close a finding with a reason. Requires write scope. Rate-limited. Args: finding_id (> 0), reason (mitigated/false_positive/out_of_scope/duplicate), note (optional closure note). Returns JSON with updated finding.

  • create_engagementwrite action

    Create a new engagement. Requires write scope. Rate-limited. Args: product_id (> 0), name, target_start (YYYY-MM-DD), target_end (YYYY-MM-DD). Returns JSON with created engagement.

  • create_findingwrite action

    Create a new finding. Requires write scope. Rate-limited. Args: test_id (> 0), title, severity (Critical/High/Medium/Low/Info), description, active (default true), verified (default false). Returns JSON with created finding.

  • create_productwrite action

    Create a new product. Requires write scope. Rate-limited. Args: name, description, prod_type_id (must be > 0). Returns JSON with created product.

  • create_testwrite action

    Create a new test. Requires write scope. Rate-limited. Args: engagement_id (> 0), test_type_id (> 0), target_start (YYYY-MM-DD), target_end (YYYY-MM-DD). Returns JSON with created test.

  • get_engagement

    Get a single engagement by ID. Args: engagement_id (must be > 0). Returns JSON with engagement fields.

  • get_finding

    Get a single finding by ID. Args: finding_id (must be > 0). Returns JSON with finding fields.

  • get_product

    Get a single product by ID. Args: product_id (must be > 0). Returns JSON with id, name, description, prod_type fields.

  • get_test

    Get a single test by ID. Args: test_id (must be > 0). Returns JSON with test fields.

  • health_check

    Check connectivity to the DefectDojo instance. Returns JSON with status 'ok' or 'unhealthy' and a message.

  • import_scan

    Import a scan report into DefectDojo. Requires write scope. Rate-limited.

  • list_engagements

    List engagements for a product. Args: product_id (> 0), limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

  • list_finding_notes

    List notes for a finding. Args: finding_id (> 0). Returns universal envelope `{"items": [...], "pagination": {...}}` with note `entry` F-002 wrapped.

  • list_findings

    List findings with optional filters. Args: test_id, product_id, engagement_id (all optional, > 0); severity (Critical/High/Medium/Low/Info); active, verified, duplicate, false_p, out_of_scope, is_mitigated, risk_accepted, outside_of_sla (all optional booleans); tags (optional list); component_name, title (optional strings); limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array

  • list_product_types

    List product types in DefectDojo. Use this to find valid prod_type_id values for create_product. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

  • list_products

    List products in DefectDojo. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

  • list_test_types

    List test types in DefectDojo. Use this to find valid test_type_id values for create_test. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

  • list_tests

    List tests for an engagement. Args: engagement_id (> 0), limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

  • reimport_scan

    Re-import a scan report into an existing test in DefectDojo. Requires write scope. Rate-limited.

  • remove_finding_tagswrite action

    Remove tags from a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), tags (non-empty list of tag strings to remove). Returns JSON with tags array.

  • reopen_finding

    Reopen a previously mitigated finding. Requires engagement_mgmt permission — reopening signals remediation failure and is gated above finding_mgmt. Rate-limited. Args: finding_id (> 0), note (optional reason for reopening). Returns JSON with updated finding.

  • update_findingwrite action

    Update an existing finding. Requires write scope. Rate-limited. Args: finding_id (> 0), plus optional: title, severity (Critical/High/Medium/Low/Info), description, active, verified, false_p, duplicate, out_of_scope, is_mitigated. At least one field required. Returns JSON with updated finding. State-transition gate (F-008/F-018): mitigated→unmitigated cascades (active=true, explicit is_mitigated=f

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan8 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 106 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How DefectDojo compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 38% of 48,255 servers
Tools
24
the typical server has 7
Tools that change things
25%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
33
more than 22% of 12,191 servers with a package

What its tools let an agent do: 14 read · 7 create · 2 change · 1 delete

Install DefectDojo in Claude Code, Cursor or VS Code

claude mcp add mcp-defectdojo -- uvx mcp-defectdojo
Add to Cursor

What the publisher says

From the DefectDojo repository's README, as published. We do not edit it. Read it on GitHub

<!-- mcp-name: io.github.inspicere/mcp-defectdojo -->

mcp-defectdojo

MCP server for DefectDojo vulnerability management. Exposes 24 tools for managing products, engagements, tests, findings, scan imports, and finding lifecycle through the Model Context Protocol.

Getting Started Guide — step-by-step setup, from install through connecting your first MCP client.

Quick Start

git clone https://github.com/inspicere/mcp-defectdojo.git && cd mcp-defectdojo
cp .env.example .env
# Edit .env — set DEFECTDOJO_URL and DEFECTDOJO_API_KEY
uv sync --frozen
uv run mcp-defectdojo

Requires Python 3.12+, uv, and a running DefectDojo instance.

Configuration

All configuration is via environment variables. Copy env.example to .env for local development.

Required

Optional — Dual API Key Mode

For least-privilege access, use separate read/write keys instead of DEFECTDOJOAPIKEY:

Optional — MCP Authentication (RBAC)

Token-role bindings using MCPROLE env vars (preferred):

Four roles are available, each inheriting from the one below:

Example: MCPROLECI=tok_abc123:scanner grants the token scanner-level access.

Legacy variables (mapped to RBAC roles for backward compatibility):

Optional — Transport

Optional — Security

Optional — Logging & Audit

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

DefectDojo: common questions

Is DefectDojo MCP server safe?
Mostly: it is graded B (72/100). Read the DefectDojo safety report
How do I install DefectDojo?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does DefectDojo need an API key?
Yes. The registry entry asks for DEFECTDOJO_API_KEY, DEFECTDOJO_READ_API_KEY, DEFECTDOJO_WRITE_API_KEY, MCP_AUTH_TOKEN and 1 more.
Is DefectDojo maintained?
The last commit was 143 days ago (2026-06-14). The latest release is v3.3.2.
How does DefectDojo compare with other MCP servers?
safety score 72/100 (higher than 38% of 48,255 servers); tools 24 (the typical server has 7); tools that change things 25% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.