Skip to main content
Glama
dcianciulli

DefectDojo MCP Server

by dcianciulli

close_finding_mitigated

Close a DefectDojo finding as mitigated after a fix is applied, optionally recording a note about how it was remediated.

Instructions

Close a finding because the vulnerability was remediated (fix applied).

Args: finding_id: The finding ID to close note: How/where it was fixed (recommended) note_type: Optional note type ID (see list_note_types) mitigated: Mitigation datetime (ISO 8601, defaults to now server-side)

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
noteNo
mitigatedNo
note_typeNo
finding_idYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does disclose useful traits: 'mitigated' defaults to now server-side, 'note' is recommended, and note_type points to list_note_types. However it says nothing about permissions or reversibility (reopen_finding exists as a sibling), leaving meaningful gaps for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose sentence is front-loaded and every parameter entry earns its place. The Args block is slightly verbose but standard and non-redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained. For a mutation tool with no annotations, the definition documents every parameter, defaults, and a cross-reference, which is nearly sufficient; only permission and reversibility context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does document all four parameters with meaning: finding_id, note (how/where fixed, recommended), note_type (ID, cross-referencing list_note_types), and mitigated (ISO 8601, server-side default). The cross-reference and default behavior add real value beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Close a finding') and names the reason ('because the vulnerability was remediated (fix applied)'), which implicitly distinguishes it from close_finding_duplicate and close_finding_false_positive. It stops short of explicitly routing the agent away from those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The reason clause ('remediated/fix applied') implies the correct scenario for this tool versus other close_* variants, but there is no explicit when-to-use or when-not-to-use guidance and no named alternatives. Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.