Skip to main content
Glama
dcianciulli

DefectDojo MCP Server

by dcianciulli

create_test

Create a new test in DefectDojo to track security assessments. Specify engagement, test type, start/end dates, and optional details like title, description, and tags.

Instructions

Create a new test.

Args: engagement_id: Engagement ID this test belongs to test_type_id: Test type ID target_start: Target start datetime (YYYY-MM-DD or ISO format) target_end: Target end datetime title: Test title description: Test description lead_id: Lead user ID environment_id: Environment ID version: Version string branch_tag: Branch or tag build_id: Build identifier commit_hash: Commit hash tags: List of tags

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
tagsNo
titleNo
lead_idNo
versionNo
build_idNo
branch_tagNo
target_endYes
commit_hashNo
descriptionNo
target_startYes
test_type_idYes
engagement_idYes
environment_idNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing beyond 'Create'. It does not mention permissions required, whether the test is created in an active state, why an engagement_id is needed, or any side effects. For a 13-parameter mutation with zero annotation coverage this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The one-line purpose is front-loaded and the Args list is compact and scannable with no filler prose. The listing is mechanical rather than economized, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be documented. What remains missing is the mutation context an agent needs before calling a create tool: required-vs-optional distinction is left to the schema, and permissions/state effects are absent. Adequate as a parameter glossary, incomplete as a tool description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and listing every parameter is a genuine step up from the bare schema. The compensation is shallow, though: entries like 'Test type ID', 'Build identifier', and 'Commit hash' are near-tautological, and only target_start adds real meaning with the '(YYYY-MM-DD or ISO format)' hint. It gives the parameter vocabulary but not identifiers, sources, or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource ('Create a new test'), so an agent immediately knows what the tool does and can distinguish it from update_test/delete_test in the sibling list. However, it makes no effort to differentiate from adjacent create_* tools beyond the resource name, so it stays one notch below top marks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus alternatives (e.g., create_finding or import_scan), no prerequisites such as needing an existing engagement or test type, and no note about which fields are mandatory. The Args block lists what can be passed, not when or why.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.