Skip to main content
Glama
dcianciulli

DefectDojo MCP Server

by dcianciulli

close_finding

Close a DefectDojo finding by marking it false positive, mitigated, or duplicate, with an optional note recorded at closure time.

Instructions

Close a finding. Requires closure_type; use the dedicated tools below when unsure.

Prefer the semantic aliases:

  • close_finding_false_positive(finding_id, note)

  • close_finding_mitigated(finding_id, note)

  • close_finding_duplicate(finding_id, duplicate_of)

Args: finding_id: The finding ID to close closure_type: One of "false_positive", "mitigated", "duplicate" note: Optional note recorded on the finding at closure time note_type: Optional note type ID (see list_note_types) mitigated: Mitigation datetime (ISO 8601, defaults to now) out_of_scope: Mark finding as out of scope (only meaningful with closure_type="false_positive") duplicate: Mark finding as duplicate (only meaningful with closure_type="duplicate")

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
noteNo
duplicateNo
mitigatedNo
note_typeNo
finding_idYes
closure_typeNomitigated
out_of_scopeNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it does disclose the default behavior (closure_type defaults to 'mitigated', mitigated datetime defaults to now) and the semantics of the out_of_scope and duplicate flags. It does not mention permissions, side effects such as notifications, or reversibility (the sibling reopen_finding hints closure is not final), so it falls short of full disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-line purpose followed by routing guidance and an Args block; every sentence adds information, no filler or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained, and the description covers parameters, defaults, and alternatives well. The remaining gap is behavioral context for a mutation (permissions, side effects, whether reopening is possible), which leaves it just short of complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and 7 parameters are present, so the description must compensate — and it does, documenting every parameter: finding_id, closure_type with its enum values, note, note_type (with a pointer to list_note_types), mitigated (ISO 8601 + default), and the two conditional booleans.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Close a finding') and immediately distinguishes itself from the close_finding_false_positive / _mitigated / _duplicate siblings by declaring a preference for them when the caller is unsure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the three alternative tools, gives their signatures, and states the condition under which each should be used instead ('use the dedicated tools below when unsure', 'Prefer the semantic aliases'). No inference is required to route correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.