DefectDojo MCP Server

A Model Context Protocol (MCP) server that provides comprehensive access to DefectDojo vulnerability management platform.

Features

• Findings: List, create, update, close, verify, manage duplicates, notes, metadata

• Products/Assets: CRUD operations with filtering by org, lifecycle, tags

• Engagements: Create, update, close engagements with full lifecycle support

• Tests: Manage tests, test types, and associated notes

• Scan Import/Reimport: Import scan results from 180+ scanners with auto-create context

• Organizations: Manage product types (organizations)

• Users: User management and current user profile

• Endpoints: List and inspect endpoints and their statuses

• JIRA Integration: Manage JIRA instances, projects, and finding mappings

• System Administration: System settings, Celery status/queue management, risk acceptance, SLA, notifications

Related MCP server: MCP Vulnerability Checker Server

Installation

From GitHub (recommended for Kiro/Claude)

uvx --from git+https://github.com/dcianciulli/defectdojo-mcp-server defectdojo-mcp-server

From source

git clone https://github.com/dcianciulli/defectdojo-mcp-server.git
cd defectdojo-mcp-server
pip install -e .

Configuration

Environment Variables

MCP Configuration (Kiro / Claude Desktop)

Add to your mcp.json (or ~/.kiro/settings/mcp.json):

{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/dcianciulli/defectdojo-mcp-server", "defectdojo-mcp-server"],
      "env": {
        "DEFECTDOJO_URL": "https://dojo.example.com",
        "DEFECTDOJO_API_KEY": "your-api-key-here"
      },
      "autoApprove": [
        "list_findings",
        "get_finding",
        "list_products",
        "get_product",
        "list_engagements",
        "get_engagement",
        "list_tests",
        "get_test",
        "list_test_types",
        "list_organizations",
        "get_organization",
        "list_users",
        "get_user",
        "get_current_user",
        "list_endpoints",
        "get_endpoint",
        "list_endpoint_status",
        "list_jira_instances",
        "list_jira_projects",
        "list_jira_finding_mappings",
        "get_celery_status",
        "get_system_settings",
        "list_risk_acceptances",
        "list_notifications",
        "list_sla_configurations"
      ]
    }
  }
}

Getting Your API Key

1. Log into DefectDojo

2. Go to your user profile (top-right menu → API v2 Key)

3. Copy the token value

Available Tools

Findings (14 tools)

• list_findings - List/search findings with extensive filters

• get_finding - Get finding details

• create_finding - Create new finding

• update_finding - Partial update

• close_finding - Close (mitigate) a finding

• verify_finding - Mark as verified

• delete_finding - Delete a finding

• get_finding_duplicates - Get duplicates

• reset_finding_duplicate_status - Reset duplicate status

• list_finding_notes / add_finding_note - Manage notes

• list_finding_metadata / add_finding_metadata - Manage metadata

• accept_risks - Accept risk for findings

Products/Assets (5 tools)

• list_products / get_product / create_product / update_product / delete_product

Engagements (8 tools)

• list_engagements / get_engagement / create_engagement / update_engagement

• close_engagement / delete_engagement

• list_engagement_notes / add_engagement_note

Tests (8 tools)

• list_tests / get_test / create_test / update_test / delete_test

• list_test_types

• list_test_notes / add_test_note

Scan Import (2 tools)

• import_scan - Import new scan results

• reimport_scan - Reimport (update existing test)

Organizations (5 tools)

• list_organizations / get_organization / create_organization / update_organization / delete_organization

Users (6 tools)

• list_users / get_user / get_current_user / create_user / update_user / delete_user

Endpoints (3 tools)

• list_endpoints / get_endpoint / list_endpoint_status

JIRA (4 tools)

• list_jira_instances / get_jira_instance / create_jira_instance

• list_jira_projects / list_jira_finding_mappings

System (10 tools)

• get_system_settings / update_system_settings

• get_celery_status / get_celery_queue_details / purge_celery_queue / purge_celery_task

• list_risk_acceptances / get_risk_acceptance / create_risk_acceptance / delete_risk_acceptance

• list_notifications / list_sla_configurations

Authentication

The server authenticates using the DefectDojo API token mechanism. All API calls include the header:

Authorization: Token <DEFECTDOJO_API_KEY>

The token inherits the permissions of the user who generated it. Actions are performed on behalf of that user.

Supported Scan Types

DefectDojo supports 180+ scan types. Common ones include:

• ZAP Scan, Burp XML, Burp API

• Nessus Scan, Qualys Scan

• SARIF (generic static analysis)

• Trivy Scan, Grype

• SonarQube Scan, Semgrep JSON Report

• Dependency Check Scan, Snyk Code Scan

• AWS Security Hub, AWS Prowler

• GitLab SAST Report, GitLab DAST Report

• Checkmarx Scan, Veracode Scan

Use list_test_types to get the full list from your instance.

Development

git clone https://github.com/dcianciulli/defectdojo-mcp-server.git
cd defectdojo-mcp-server
pip install -e ".[dev]"

License

MIT