DefectDojo MCP Server

create_user

Create a new user account in DefectDojo. Specify username, name, email, and permissions to manage access.

Instructions

Create a new user.

Args: username: Username first_name: First name last_name: Last name email: Email address is_active: Active status is_superuser: Superuser status

Input Schema

TableJSON Schema

Name	Required	Description	Default
`email`	No
`username`	Yes
`is_active`	No
`last_name`	No
`first_name`	No
`is_superuser`	No

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Sep 11, 2026

TDQS

C2.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does not state required permissions, whether the user is immediately active, any validation rules, or side effects. For a write operation creating an identity record, this leaves critical behavioral context undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first line is appropriately front-loaded and concise. The Args block adds length without value since each line is a tautology of the parameter name. Not excessively long, but the structure wastes lines on redundant labels.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. However, with no annotations, 0% schema coverage, and a purely tautological Args block, the description is insufficient for a six-parameter creation tool. It is barely adequate rather than complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description is the only documentation. The Args section merely restates the parameter names as human-readable labels ('Username', 'Email address') without adding any semantic detail like format, constraints, or defaults. One required parameter is not called out.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create a new user'), which is unambiguous against siblings like create_organization or create_product. It does not explicitly differentiate from update_user or delete_user, but the verb itself does that work.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus update_user or other creation tools, and no prerequisites mentioned. The description simply names the operation without any routing context, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server