Claude MarketplacesSubmit

DefectDojo

inspicere/mcp-defectdojo

This connects Claude to your DefectDojo instance for full lifecycle vulnerability management. You get 24 tools covering products, engagements, tests, findings, and scan imports. Ships with token-based RBAC (four roles from reader to admin), HMAC-chained audit logs, and SIEM forwarding over syslog or HTTPS. Useful when you want LLM-assisted triage, bulk finding updates, or natural language queries against your vuln pipeline without writing DefectDojo API scripts. Requires dual API keys for read/write separation, enforces TLS by default, and includes per-token rate limiting on mutations. Network transports require persistent HMAC keys and authentication or they refuse to start.

tools: 24
auth: Secret needed
transport: STDIO
env vars: 6
last updated: May 28, 2026

Tools

24 tools

Public tool metadata for what this MCP can expose to an agent.

health_checkCheck connectivity to DefectDojo

Check connectivity to DefectDojo

No parameter schema in public metadata yet.

list_productsList products with pagination

List products with pagination

No parameter schema in public metadata yet.

get_productGet a single product by ID

Get a single product by ID

No parameter schema in public metadata yet.

list_product_typesList product types (for use in `create_product`)

List product types (for use in `create_product`)

No parameter schema in public metadata yet.

list_engagementsList engagements for a product

List engagements for a product

No parameter schema in public metadata yet.

get_engagementGet a single engagement by ID

Get a single engagement by ID

No parameter schema in public metadata yet.

list_testsList tests for an engagement

List tests for an engagement

No parameter schema in public metadata yet.

get_testGet a single test by ID

Get a single test by ID

No parameter schema in public metadata yet.

list_test_typesList test types (for use in `create_test`)

List test types (for use in `create_test`)

No parameter schema in public metadata yet.

list_findingsList findings with 18 filter parameters

List findings with 18 filter parameters

No parameter schema in public metadata yet.

get_findingGet a single finding by ID

Get a single finding by ID

No parameter schema in public metadata yet.

list_finding_notesList notes on a finding

List notes on a finding

No parameter schema in public metadata yet.

create_productCreate a new product

Create a new product

No parameter schema in public metadata yet.

create_engagementCreate a new engagement

Create a new engagement

No parameter schema in public metadata yet.

create_testCreate a new test

Create a new test

No parameter schema in public metadata yet.

create_findingCreate a new finding

Create a new finding

No parameter schema in public metadata yet.

update_findingUpdate an existing finding

Update an existing finding

No parameter schema in public metadata yet.

close_findingClose a finding with reason (mitigated/false_positive/out_of_scope/duplicate)

Close a finding with reason (mitigated/false_positive/out_of_scope/duplicate)

No parameter schema in public metadata yet.

reopen_findingReopen a closed finding (clears `is_mitigated`/`false_p`/`out_of_scope`/`duplicate`, sets `active=true`)

Reopen a closed finding (clears `is_mitigated`/`false_p`/`out_of_scope`/`duplicate`, sets `active=true`)

No parameter schema in public metadata yet.

add_finding_noteAttach a note to a finding

Attach a note to a finding

No parameter schema in public metadata yet.

add_finding_tagsAdd tags to a finding

Add tags to a finding

No parameter schema in public metadata yet.

remove_finding_tagsRemove tags from a finding

Remove tags from a finding

No parameter schema in public metadata yet.

import_scanUpload scan results (225+ scan types, multipart)

Upload scan results (225+ scan types, multipart)

No parameter schema in public metadata yet.

reimport_scanRe-upload scan results to an existing test

Re-upload scan results to an existing test

No parameter schema in public metadata yet.

Sponsors

Promote your product hereReach 125k+ visitors monthly Promote your product hereReach 125k+ visitors monthly

Agent CaffeineSponsoredClose your lid, come back to finished work

SnugSponsoredThe clipboard manager for the AI era Promote your product hereReach 125k+ visitors monthly

WaxSponsoredBlock anything with supervision, without erasing your iPhone Promote your product hereReach 125k+ visitors monthly

knobsSponsoredSee your site on any phone, any day, in any language

Configuration

DEFECTDOJO_URL*

Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)

DEFECTDOJO_API_KEY*secret

API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.

DEFECTDOJO_READ_API_KEYsecret

Optional read-only API key (used for GET requests in dual-key mode)

DEFECTDOJO_WRITE_API_KEYsecret

Optional write API key (used for POST/PATCH in dual-key mode)

MCP_AUTH_TOKENsecret

Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)

AUDIT_HMAC_KEYsecret

HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'

Readme

mcp-defectdojo

MCP server for DefectDojo vulnerability management. Exposes 24 tools for managing products, engagements, tests, findings, scan imports, and finding lifecycle through the Model Context Protocol.

Getting Started Guide — step-by-step setup, from install through connecting your first MCP client.

Quick Start

git clone https://github.com/inspicere/mcp-defectdojo.git && cd mcp-defectdojo
cp .env.example .env
# Edit .env — set DEFECTDOJO_URL and DEFECTDOJO_API_KEY
uv sync --frozen
uv run mcp-defectdojo

Requires Python 3.12+, uv, and a running DefectDojo instance.

Configuration

All configuration is via environment variables. Copy env.example to .env for local development.

Required

Variable	Description
`DEFECTDOJO_URL`	Base URL of the DefectDojo instance (must use `https://` unless overridden)
`DEFECTDOJO_API_KEY`	API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key)

View the full README on GitHub

Details

Repository: github.com/inspicere/mcp-defectdojo
Package: mcp-defectdojo
Transport: STDIO
Auth: Required
Registry: MCP registry, active