DefectDojo MCP Server

This project provides a Model Context Protocol (MCP) server implementation for DefectDojo, a popular open-source vulnerability management tool. It allows AI agents and other MCP clients to interact with the DefectDojo API programmatically.

Features

This MCP server exposes tools for managing key DefectDojo entities:

• Findings: Fetch, search, create, update status, and add notes.
• Products: List available products.
• Engagements: List, retrieve details, create, update, and close engagements.

Installation & Running

There are a couple of ways to run this server:

Using uvx (Recommended)

uvx executes Python applications in temporary virtual environments, installing dependencies automatically.

Using pip

You can install the package into your Python environment using pip.

Once installed via pip, run the server using:

Configuration

The server requires the following environment variables to connect to your DefectDojo instance:

• DEFECTDOJO_API_TOKEN (required): Your DefectDojo API token for authentication.
• DEFECTDOJO_API_BASE (required): The base URL of your DefectDojo instance (e.g., https://your-defectdojo-instance.com).

You can configure these in your MCP client's settings file. Here's an example using the uvx command:

If you installed the package using pip, the configuration would look like this:

Available Tools

The following tools are available via the MCP interface:

• get_findings: Retrieve findings with filtering (product_name, status, severity) and pagination (limit, offset).
• search_findings: Search findings using a text query, with filtering and pagination.
• update_finding_status: Change the status of a specific finding (e.g., Active, Verified, False Positive).
• add_finding_note: Add a textual note to a finding.
• create_finding: Create a new finding associated with a test.
• list_products: List products with filtering (name, prod_type) and pagination.
• list_engagements: List engagements with filtering (product_id, status, name) and pagination.
• get_engagement: Get details for a specific engagement by its ID.
• create_engagement: Create a new engagement for a product.
• update_engagement: Modify details of an existing engagement.
• close_engagement: Mark an engagement as completed.

(See the original README content below for detailed usage examples of each tool)

Usage Examples

(Note: These examples assume an MCP client environment capable of calling use_mcp_tool)

Get Findings

Search Findings

Update Finding Status

Add Note to Finding

Create Finding

List Products

List Engagements

Get Engagement

Create Engagement

Update Engagement

Close Engagement

Development

Setup

1. Clone the repository.
2. It's recommended to use a virtual environment:
   python -m venv .venv source .venv/bin/activate # On Windows use `.venv\Scripts\activate`
3. Install dependencies, including development dependencies:
   pip install -e ".[dev]"

License

This project is licensed under the MIT License - see the LICENSE file for details.

Contributing

Contributions are welcome! Please feel free to open an issue for bugs, feature requests, or questions. If you'd like to contribute code, please open an issue first to discuss the proposed changes.