DefectDojo
Search, triage and import findings in DefectDojo through its REST API v2.
- GitHub stars
- 3
- tools
- 23
- auth
- Secret needed
- transport
- STDIO
- env vars
- 5
- last updated
- Nov 11, 2026
Tools
23 toolsPublic tool metadata for what this MCP can expose to an agent.
get_instance_infoInstance URL, DefectDojo version, edition (open source or Pro, best effort), current user, and whether writes are on.
Instance URL, DefectDojo version, edition (open source or Pro, best effort), current user, and whether writes are on.
No parameter schema in public metadata yet.
list_findingsSearch findings by product, engagement, test, product type, severity, active, verified, duplicate, false positive, risk accepted, mitigated, out of scope, CVE or other vulnerability id, CWE, title text, component, file path, tags and dates. Sortable.
Search findings by product, engagement, test, product type, severity, active, verified, duplicate, false positive, risk accepted, mitigated, out of scope, CVE or other vulnerability id, CWE, title text, component, file path, tags and dates. Sortable.
No parameter schema in public metadata yet.
get_findingOne finding with full text fields, vulnerability ids, CWE, file path, component, notes, affected endpoints or locations, and its test, engagement and product.
One finding with full text fields, vulnerability ids, CWE, file path, component, notes, affected endpoints or locations, and its test, engagement and product.
No parameter schema in public metadata yet.
get_finding_statsExact counts by severity and by status for a product, engagement, test, product type or the whole instance.
Exact counts by severity and by status for a product, engagement, test, product type or the whole instance.
No parameter schema in public metadata yet.
list_finding_notesNotes on a finding.
Notes on a finding.
No parameter schema in public metadata yet.
list_productsProducts. Newer releases call them assets.
Products. Newer releases call them assets.
No parameter schema in public metadata yet.
get_productProducts. Newer releases call them assets.
Products. Newer releases call them assets.
No parameter schema in public metadata yet.
list_product_typesProduct types. Newer releases call them organizations.
Product types. Newer releases call them organizations.
No parameter schema in public metadata yet.
list_engagementsEngagements.
Engagements.
No parameter schema in public metadata yet.
get_engagementEngagements.
Engagements.
No parameter schema in public metadata yet.
list_testsTests, meaning individual scan imports or manual tests.
Tests, meaning individual scan imports or manual tests.
No parameter schema in public metadata yet.
get_testTests, meaning individual scan imports or manual tests.
Tests, meaning individual scan imports or manual tests.
No parameter schema in public metadata yet.
list_scan_typesScan types the instance can import, for use as scan_type.
Scan types the instance can import, for use as scan_type.
No parameter schema in public metadata yet.
list_test_importsImport and reimport history for a test, with the findings each run created, closed, reactivated or left untouched.
Import and reimport history for a test, with the findings each run created, closed, reactivated or left untouched.
No parameter schema in public metadata yet.
get_current_userThe user the API key belongs to.
The user the API key belongs to.
No parameter schema in public metadata yet.
list_locationsHosts, URLs and other locations. Uses the locations API on newer releases and the endpoints API on older ones.
Hosts, URLs and other locations. Uses the locations API on newer releases and the endpoints API on older ones.
No parameter schema in public metadata yet.
import_scanUpload a scan report as a new test. Target an engagement id, or name a product and engagement and let DefectDojo create them with auto_create_context. Supports close_old_findings, minimum_severity, tags, scan date, version and CI metadata.
Upload a scan report as a new test. Target an engagement id, or name a product and engagement and let DefectDojo create them with auto_create_context. Supports close_old_findings, minimum_severity, tags, scan date, version and CI metadata.
No parameter schema in public metadata yet.
reimport_scanUpload a newer report into an existing test so DefectDojo closes fixed findings and adds new ones.
Upload a newer report into an existing test so DefectDojo closes fixed findings and adds new ones.
No parameter schema in public metadata yet.
add_finding_noteAdd a note to a finding.
Add a note to a finding.
No parameter schema in public metadata yet.
update_finding_statusSet active, verified, false positive, out of scope, or mitigated (with an optional date and note).
Set active, verified, false positive, out of scope, or mitigated (with an optional date and note).
No parameter schema in public metadata yet.
risk_accept_findingsRisk accept, or revoke acceptance for, up to 50 findings with DefectDojo's simple risk acceptance.
Risk accept, or revoke acceptance for, up to 50 findings with DefectDojo's simple risk acceptance.
No parameter schema in public metadata yet.
create_productCreate a product in a product type.
Create a product in a product type.
No parameter schema in public metadata yet.
create_engagementCreate an engagement in a product.
Create an engagement in a product.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
DEFECTDOJO_URL*Base URL of your DefectDojo instance, for example https://defectdojo.example.com
DEFECTDOJO_API_KEY*secretDefectDojo API v2 key
DEFECTDOJO_ALLOW_WRITESdefault: falseSet to true to enable write tools. Read-only by default.
DEFECTDOJO_VERIFY_SSLdefault: truetrue, false, or a path to a CA bundle
DEFECTDOJO_IMPORT_DIRSFolders that scan reports may be read from for imports
Readme
DefectDojo MCP Server
The official open-source Model Context Protocol server for DefectDojo.
It lets Claude, Cursor, VS Code and other MCP clients work with your DefectDojo instance through the DefectDojo REST API v2. Ask an assistant to find the open critical findings in a product, explain a finding, compare two imports, or (when you turn writes on) import a scan and update finding status.
- Works with open-source DefectDojo 2.x and 3.x, and with DefectDojo Pro.
- Read-only by default. Write tools only exist when you enable them.
- Text from DefectDojo is marked as untrusted, because scanner output can carry prompt injection.
- Runs locally over stdio, or as a streamable HTTP server with authentication.
- No telemetry of any kind.
Quick start
You need:
Details
- Repository
- github.com/defectdojo/defectdojo-mcp
- Website
- github.com/DefectDojo/defectdojo-mcp
- Category
- Search & Web Crawling
- Package
defectdojo-mcp-server- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
Related Search & Web Crawling MCP servers
View all
Open Food Factsdomdomegg/openfoodfacts-mcpSearch and contribute to the Open Food Facts database.3stars
Codex Mcp Bridgehampsterx/codex-mcp-bridgeWraps Codex CLI as MCP tools: codex, review, query, search, structured, ping, listSessions.3stars
Vim Mcpiggredible/vim-mcpConnect Claude Code to Vim/Neovim - query state, execute commands, search help, record macros3stars
Apple Adshappygallo/apple-ads-mcpManage Apple Search Ads campaigns, keywords, budgets, and reports via API v5.3stars
Fossicklipdog/fossick-mcpSearch all of GitHub from your AI agent — find libraries, drill into repos, find code patterns.3stars
Deltamarkswendsen-code/mcp-deltaMCP server for Delta Airlines - search flights, check status, manage trips3stars