Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Dradis MCP Create a new project named 'Security Audit'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A FastMCP server implementation for interacting with Dradis Pro, a collaborative platform for information security teams. This MCP allows you to manage projects and vulnerabilities in Dradis directly through your MCP-enabled tools.
Project Management
Create new projects
Get project details
Set active project for operations
Vulnerability Management
Create vulnerabilities
Update existing vulnerabilities
Get vulnerability details
Get all vulnerability details
List vulnerabilities with pagination support
Content Block Management
Get all content blocks in current project
Update a content block
Document Property Management
Get all document properties
Create or update a document property
Robust error handling and input validation
Consistent JSON response formatting
Related MCP server: mcp-defectdojo
Node.js (v14 or higher)
npm
A Dradis Pro instance
Dradis API token
npm installCreate a .env file in the root directory with the following variables:
DRADIS_URL=<url>
DRADIS_API_TOKEN=<token>
DRADIS_DEFAULT_TEAM_ID=<teamId>
DRADIS_DEFAULT_TEMPLATE_ID=<templateId>
DRADIS_VULNERABILITY_PARAMETERS=<commaSeparatedParams> // Title,Description,Solution,etc. To add Dradis MCP to your MCP configuration, add the following to your config file to mcp.json if you're using 5ire:
{
"servers": [
{
"key": "Dradis",
"command": "npx",
"description": "A Model Context Protocol server that provides integration with Dradis note-taking platform",
"args": ["-y", "dradis-mcp"],
"env": {
"DRADIS_URL": "<url:string:Your Dradis instance URL>",
"DRADIS_API_TOKEN": "<token:string:Your Dradis API token>",
"DRADIS_DEFAULT_TEAM_ID": "<number:string:Default team ID for project creation>",
"DRADIS_DEFAULT_TEMPLATE_ID": "<number:string:Default template ID for project creation>"
},
"isActive": false
}
]
}setProject: Set the current Dradis project
{ projectId: number }getProjectDetails: Get details of the current project
// No parameters requiredcreateProject: Create a new Dradis project
{
name: string;
team_id?: number; // Optional if DRADIS_DEFAULT_TEAM_ID is set
report_template_properties_id?: number; // Optional if DRADIS_DEFAULT_TEMPLATE_ID is set
author_ids?: number[];
template?: string; // Optional if DRADIS_DEFAULT_TEMPLATE is set
}createVulnerability: Create a new vulnerability
{
text: string; // Content with #[ ]# field syntax
}getVulnerabilities: List vulnerabilities (25 per page)
{
page?: number; // Optional page number
}getVulnerability: Get specific vulnerability
{
vulnerabilityId: number;
}updateVulnerability: Update existing vulnerability
{
issueId: number;
parameters: {
text: string;
}
}getContentBlocks: Get all content blocks in current project
// No parameters requiredupdateContentBlock: Update a content block
{
blockId: number;
contentBlock: {
content: string;
}
}getDocumentProperties: Get all document properties
// No parameters requiredupsertDocumentProperty: Create or update a document property
{
propertyName: string;
value: string;
}To run the server in development mode with the CLI:
npm run devTo inspect the server using MCP Inspector:
npm run inspectTo build the TypeScript code:
npm run buildTo run the built server:
npm start/src - Source code
api.ts - Dradis API client implementation
config.ts - Configuration loading and validation
server.ts - MCP server implementation
types.ts - TypeScript type definitions
/dist - Compiled JavaScript (generated after build)
The MCP provides detailed error messages for:
Missing or invalid configuration
API request failures
Invalid input parameters
Missing project ID
Network errors
All tool responses are formatted as JSON with consistent structure:
Success responses include relevant data and optional success messages
Error responses include detailed error messages and context
List endpoints include pagination metadata when applicable
Create a new Dradis project with specified configuration and automatically set it as the current project context
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| team_id | Yes | ||
| template | No | ||
| author_ids | No | ||
| report_template_properties_id | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It usefully reveals the side effect of setting the new project as the current project context, which goes beyond the schema. However, it doesn't discuss other relevant behaviors such as permission requirements, reversibility, or what happens on failure, so it's partially transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-front-loaded sentence that states the action and a key side effect. It contains no fluff and earns its place, making it highly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no annotations, and no output schema, the description is far too sparse. It doesn't explain the meaning of required/optional parameters, expected return values, or any operational constraints. It covers the basic purpose and one side effect but leaves major gaps for an agent to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for explaining the parameters. It does not: the phrase 'specified configuration' is vague and provides no meaning for name, team_id, template, author_ids, or report_template_properties_id. The tool fails to add any parameter-level clarity beyond what the bare schema types offer.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the primary action ('Create') and the specific resource ('Dradis project'), and it adds a distinct side effect ('automatically set it as the current project context'). This distinguishes it from sibling tools like setProject (which likely only sets context) and getProjectDetails (read-only).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, exclusions, or cases where a sibling like setProject would be more appropriate. The only implicit guidance is that you use it to create a new project, but no explicit comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Create a new security vulnerability finding in the current project with detailed information
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the creation action and does not disclose side effects, required data, permissions, or return behavior. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no repetition or unnecessary words. Efficient and clear in structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the open-ended schema and lack of annotations/output schema, the description is too minimal. It does not explain what 'detailed information' should include, how to set the current project, or what the tool returns, leaving critical gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero declared parameters but allows arbitrary additional string properties. The description mentions 'detailed information' but does not enumerate expected fields. With no explicit parameters, baseline is 3, and the vague phrase adds little value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Create'), the resource ('security vulnerability finding'), and the scope ('in the current project'), which distinguishes it from sibling tools like getVulnerabilities, updateVulnerability, and createProject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for creating new vulnerability findings, clearly distinguished from updateVulnerability for modifications. However, it does not explicitly mention alternatives or when not to use it, so it lacks full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve a paginated list of complete vulnerability details including all fields and metadata from the current project
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number for pagination (25 items per page) | |
| filterByRisk | No | Filter vulnerabilities by risk rating |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It correctly indicates a read operation via 'Retrieve', and mentions pagination and filtering, but lacks deeper behavioral context such as response size, ordering, or reliance on a previously set project. The description does not contradict annotations because none exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clearly structured sentence. It front-loads the action and resource, and every phrase ('paginated list', 'complete vulnerability details', 'all fields and metadata') conveys meaningful information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only two optional parameters and no output schema, but the description omits important context: it does not mention that the project must be set beforehand (despite setProject being a sibling), nor does it explain when this tool should be preferred over getVulnerabilities. The pagination and filter capabilities are described via schema, but the overall operational context is thin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides complete descriptions and defaults for both parameters (page with 25 items per page, filterByRisk enum). The description adds no additional parameter detail beyond the general notion of pagination, so it neither compensates nor detracts from the schema's coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a paginated list of complete vulnerability details including all fields and metadata from the current project. It specifies a verb, resource, and scope, but does not explicitly differentiate from the sibling tool getVulnerabilities, though the phrase 'complete details' hints at the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like getVulnerabilities or getVulnerability. There are no exclusions, prerequisites, or contextual pointers, leaving the agent to infer usage solely from the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve all content blocks from the current project, including their IDs and field data
| Name | Required | Description | Default |
|---|---|---|---|
| blockGroup | No | Filter content blocks by their block group type | |
| includeContent | No | Whether to include full content in the response |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. 'Retrieve' implies a read operation, but it does not explicitly state that it is read-only, safe, or whether it requires a specific project to be set. It also does not disclose the effect of the includeContent parameter on the response, which is a significant behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and object. It is concise with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with 2 optional parameters and no output schema, the description is partially complete. It clearly states what is returned, but it does not clarify what 'current project' means (e.g., whether a project must be set beforehand), and it omits any mention of filtering behavior or pagination. The schema fills in parameter details, but the ambiguity around project context is a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already documented. The description adds a small amount of context by mentioning 'IDs and field data', which loosely relates to the includeContent parameter, but it does not meaningfully enhance the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Retrieve' and resource 'all content blocks from the current project', clearly distinguishing it from sibling tools like updateContentBlock. It also mentions the type of data returned (IDs and field data), which adds clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when content blocks are needed, but does not explicitly state when to use it versus alternatives. There is no mention of exclusions or that updateContentBlock should be used for modifications, so the guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve all document properties and their values for the current project configuration
| Name | Required | Description | Default |
|---|---|---|---|
| includeEmpty | No | Whether to include properties with empty values | |
| propertyPrefix | No | Filter properties by name prefix (e.g., 'dradis.' for system properties) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral safety. The verb 'retrieve' indicates a read operation, which partially covers the read-only nature. However, it doesn't disclose return format, error behavior, or whether system properties are included by default, leaving some behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no redundant words, front-loads the action and resource. No filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read operation with two optional parameters and no output schema, the description is sufficient for basic usage. It lacks explicit read-only confirmation and potential response shape, but the 'retrieve' verb and resource scope cover the essential context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides complete descriptions for both parameters (includeEmpty, propertyPrefix) at 100% coverage. The description does not add parameter-specific details beyond stating 'all document properties', which matches the schema's coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieve' and the specific resource 'all document properties and their values' scoped to 'current project configuration'. This distinguishes it from sibling tools: upsertDocumentProperty is a write operation, and getProjectDetails focuses on project details rather than document properties.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context (current project configuration) but no explicit when-to-use vs alternatives. It does not mention when not to use this tool or which sibling to prefer for different scenarios, though the read/write distinction with upsertDocumentProperty is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get detailed information about the current Dradis project including metadata, team, and settings
| Name | Required | Description | Default |
|---|---|---|---|
| includeMetadata | No | Whether to include additional project metadata in the response |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full burden of behavioral disclosure. It only states that the tool gets information, without detailing response format, potential side effects (though read-only implied), or any contextual requirements. It does not go beyond the obvious 'get' semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that immediately states the tool's purpose and key output components. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description offers some context by listing metadata, team, and settings, but without an output schema or annotations, it leaves uncertainty about exact response structure and potential constraints. It is minimally viable for a simple getter but could benefit from more detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the only parameter 'includeMetadata' with a clear description and default. Since schema coverage is 100%, the description does not need to add parameter details, and it does not provide any extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'detailed information about the current Dradis project', listing specific aspects (metadata, team, settings). This makes the tool's purpose distinct from siblings like createProject and setProject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to retrieve project details but provides no explicit guidance on when to use it versus other tools (e.g., when to prefer getProjectDetails over getVulnerabilities or updateContentBlock). No exclusions or alternative tools are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve a paginated list of vulnerability summaries from the current project, including ID, title, and risk rating
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number for pagination (25 items per page) | |
| includeFields | No | Specific vulnerability fields to include in the response |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses the paginated nature, summary-level content, and project scoping. The word 'Retrieve' signals a read operation, though it does not explicitly say non-destructive or mention rate limits/auth, which are less critical for a list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence communicates the action, resource, scope, and response contents without redundancy. Well front-loaded and no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple list tool: it explains the return fields (since no output schema), indicates pagination, and scopes to the current project. Minor gaps like sort order or page size are already covered by the parameter schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description adds context about the response fields but no additional parameter-specific meaning, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Retrieve'), the resource ('paginated list of vulnerability summaries'), and the scope ('current project'). It specifies the included fields (ID, title, risk rating), distinguishing it from single-item or full-detail sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for retrieving summary lists and notes the 'current project' scope, but it does not explicitly state when to prefer this tool over getVulnerability or getAllVulnerabilityDetails, nor any exclusions. Guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve complete details for a specific vulnerability including all fields, evidence, and metadata
| Name | Required | Description | Default |
|---|---|---|---|
| includeEvidence | No | Whether to include associated evidence in the response | |
| vulnerabilityId | Yes | The unique ID of the vulnerability to retrieve |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose whether the operation is read-only, any permission requirements, error behavior, or how includeEvidence affects the response. Saying 'retrieve' hints at a read operation but does not explicitly guarantee safety or explain side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that states the action, resource, and output scope. The phrases 'complete details' and 'all fields' are slightly redundant, but the description is appropriately concise and has no meaningful waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should provide more behavioral and return context. It states that the response includes fields, evidence, and metadata, which is useful for a simple get-by-id tool, but it omits response structure, error conditions, and the role of includeEvidence. It is minimally viable but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters fully (vulnerabilityId and includeEvidence) with descriptions, giving high schema coverage. The description adds little beyond mentioning 'evidence' in the response, and it does not clarify the optional includeEvidence toggle, so it does not exceed the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly uses the verb 'Retrieve' and identifies the resource as 'a specific vulnerability', distinguishing it from the plural/list sibling tools like getVulnerabilities. It also lists the content scope (all fields, evidence, metadata), making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when the agent needs complete details for a single known vulnerability (supported by the required vulnerabilityId), but it never explicitly contrasts with alternatives like getVulnerabilities or getAllVulnerabilityDetails, nor states when not to use it. The usage context is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Set the current Dradis project context for all subsequent operations
| Name | Required | Description | Default |
|---|---|---|---|
| projectId | Yes | The ID of the Dradis project to set as current context |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose the key stateful behavior that it sets the context for all subsequent operations, but it does not mention potential side effects like overwriting an existing context, error behavior for invalid project IDs, or whether the context persists across sessions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded, and waste-free sentence. It conveys the purpose and scope without any unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, straightforward state-setting), the description is largely sufficient. It explains the core function and its global effect on subsequent operations, though it could be slightly more explicit about the prerequisites or consequences of setting the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (projectId has a clear description), so the baseline is 3. The description adds no additional semantic information about the parameter beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Set') and the specific resource ('current Dradis project context'), and adds the important scope 'for all subsequent operations,' which distinguishes this from sibling tools like getProjectDetails or createProject.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for all subsequent operations' implies that this should be called before other project-scoped operations, but there is no explicit guidance on when to use this tool versus alternatives, nor are there any exclusions or prerequisites mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Update a content block in the current project with new field values and content
| Name | Required | Description | Default |
|---|---|---|---|
| blockId | Yes | The unique ID of the content block to update | |
| contentBlock | Yes | Content block data including block group and field updates |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It only states that the tool 'updates' with new field values, but does not disclose whether this merges or replaces fields, permissions needed, or how invalid blockIds are handled. For a mutation tool, this lacks critical behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence, front-loaded with the verb and resource, containing zero filler. It efficiently communicates the core action and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has two well-described parameters and a nested object schema, but no output schema and no annotations. The description provides enough to invoke the tool, but lacks behavioral transparency (e.g., merge vs replace semantics, error behavior) that would make it fully contextually complete for a mutation operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are fully documented there. The tool description ('new field values and content') adds little beyond what the schema already states ('field updates'). Baseline 3 applies because the schema does the heavy lifting, with no extra semantic contribution from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Update') and resource ('content block'), scoped to 'the current project', and clarifies that it handles 'new field values and content'. This clearly distinguishes it from sibling tools like getContentBlocks (read-only) and updateVulnerability (different resource).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when an existing content block needs to be modified. It does not explicitly name alternatives or exclusions, but the 'update' verb and resource specificity make the intended usage unambiguous against the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Update an existing vulnerability with new information, modifying only the specified fields
| Name | Required | Description | Default |
|---|---|---|---|
| issueId | Yes | The unique ID of the vulnerability to update | |
| parameters | Yes | Vulnerability fields to update with new values |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The phrase 'modifying only the specified fields' discloses partial-update behavior, which is useful context. However, with no annotations, the description omits permissions, return value, or failure modes, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with the action verb, and no filler words. It is appropriately concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema or annotations, the description doesn't mention what the tool returns on success or failure. For a mutation tool, this is a notable gap, especially alongside a rich set of sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes both parameters fully, so the description adds little beyond what is structured. The description doesn't elaborate on the shape of the 'parameters' object beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update an existing vulnerability with new information,' using a specific verb and resource. It distinguishes from sibling createVulnerability by emphasizing 'existing' and 'modifying only the specified fields.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for modifying existing vulnerabilities, but doesn't explicitly contrast it with createVulnerability or other sibling tools. No alternative tools are named, and no when-to-use scenarios are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Create a new document property or update an existing property value in the current project
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes | The value to set for the property | |
| propertyName | Yes | The name of the property to create or update (e.g., 'dradis.client', 'custom.field') | |
| overwriteExisting | No | Whether to overwrite existing property values |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It mentions mutation ('create/update') and scoping ('in the current project'), but fails to disclose overwrite behavior, idempotency, error conditions, or prerequisites. The overwriteExisting parameter exists in schema but is not explained in the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that directly states the tool's purpose with no superfluous details. It is concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple upsert tool but leaves gaps: 'current project' is undefined, overwrite behavior is implicit via schema default rather than described, and no failure modes are mentioned. Combined with the schema it is usable, but it could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for all parameters, providing detailed descriptions (e.g., propertyName examples). The description itself adds no additional parameter information, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Create a new document property or update an existing property value in the current project'. The verb 'Create or update' precisely captures upsert semantics, and the resource 'document property' with scope 'current project' distinguishes it from read-only sibling tools like getDocumentProperties.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives. It does not mention exclusions or point to getDocumentProperties for retrieval. Usage is only implied by the verb 'create or update', leaving the agent to infer when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v2.1.0createProjectcreateVulnerabilitygetAllVulnerabilityDetailsgetContentBlocksgetDocumentPropertiesgetProjectDetailsgetVulnerabilitiesgetVulnerabilitysetProjectupdateContentBlockupdateVulnerabilityupsertDocumentPropertyScored across 12 tools
Most tools target distinct resources and actions, but getVulnerabilities and getAllVulnerabilityDetails both return paginated vulnerability lists and could be confused despite one providing summaries and the other full details. Other tools are clearly separated by resource type.
All tool names follow a consistent verb_noun camelCase pattern (e.g., setProject, getVulnerability, updateContentBlock). The use of 'upsert' is a common and clear convention, so there are no naming style inconsistencies.
With 12 tools, the server is well-scoped for managing Dradis projects, vulnerabilities, content blocks, and document properties. Each tool has a clear role and the count is neither overwhelming nor too sparse.
The tool surface covers create/read/update for vulnerabilities and projects, and read/update for content blocks and document properties, but lacks delete operations entirely. Also missing are project listing and content block creation, which are notable gaps for full lifecycle management.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Read and write Mission Control state via MCP — projects, tasks, subtasks, templates, status updates.
Generate PDF, Word (.docx) and PowerPoint (.pptx) documents from Markdown over MCP.
