Skip to main content
Glama
dcianciulli

DefectDojo MCP Server

by dcianciulli

create_engagement

Create a new engagement in DefectDojo to group security tests and findings for a product, specifying start/end dates, type, and status.

Instructions

Create a new engagement.

Args: name: Engagement name product_id: Product ID this engagement belongs to target_start: Target start date (YYYY-MM-DD) target_end: Target end date (YYYY-MM-DD) engagement_type: Type (Interactive or CI/CD) status: Status (Not Started, In Progress, Completed) description: Description lead_id: Lead user ID build_id: Build identifier commit_hash: Commit hash branch_tag: Branch or tag name source_code_management_uri: SCM URI deduplication_on_engagement: Dedupe scoped to engagement tags: List of tags

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYes
tagsNo
statusNoIn Progress
lead_idNo
build_idNo
branch_tagNo
product_idYes
target_endYes
commit_hashNo
descriptionNo
target_startYes
engagement_typeNoInteractive
source_code_management_uriNo
deduplication_on_engagementNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It doesn't mention permissions required, whether the operation is idempotent, what happens on duplicate names, or what the response contains. The parameter list gives some idea of what can be set, but there's no behavioral context beyond that. An output schema exists but the description doesn't reference it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, followed by a parameter list. The parameter explanations are minimal, and some are redundant. It's not overly verbose, but the structure is just a flat list without grouping or emphasis on required vs optional. Every line does serve to document a parameter, but the overall conciseness is undermined by low information density in the parameter descriptions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a 14-parameter creation tool with no annotations, 0% schema description coverage, and an output schema, the description is incomplete. It doesn't explain required vs optional parameters (though the schema does), doesn't mention permissions, doesn't describe the return value (though output schema exists), and doesn't guide on usage context. For a mutation tool with this complexity, the description should do more to inform safe and correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% – the input schema only has parameter titles with no descriptions. The description does list each parameter with a brief explanation (e.g., 'target_start: Target start date (YYYY-MM-DD)'), which adds meaning beyond the schema, especially the date format. However, many explanations are tautological (e.g., 'description: Description', 'lead_id: Lead user ID') and don't fully compensate for the lack of enum details (engagement_type, status values are mentioned but not constrained) or format specifics for other fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb+resource: 'Create a new engagement.' This is specific and unambiguous, and the sibling set contains create/update/delete/list/get engagement tools. However, it doesn't distinguish this tool from siblings like update_engagement or create_test beyond the verb, which it does sufficiently for a create operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no when-to-use guidance whatsoever. It doesn't say when to create an engagement versus importing scans (which may auto-create engagements), nor does it state prerequisites like requiring a product to exist first. There are no alternatives mentioned despite siblings like import_scan and reimport_scan that might create engagements implicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.