Skip to main content
Glama
dcianciulli

DefectDojo MCP Server

by dcianciulli

reinstate_risk_acceptance

Reinstate an expired risk acceptance by setting a new future expiration date and an optional reason. Use this to renew accepted risks in DefectDojo after their prior acceptance lapsed.

Instructions

Reinstate an expired risk acceptance with a new (mandatory) expiration date.

Args: risk_acceptance_id: The risk acceptance ID expiration_date: New expiration date (YYYY-MM-DD or ISO datetime), must be in the future reason: Optional reason

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
reasonNo
expiration_dateYes
risk_acceptance_idYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It discloses the mutation nature ('reinstate'), the mandatory requirement for a future expiration date, and that reason is optional. However, it omits key behaviors: whether reinstating a non-expired acceptance fails, what permissions are needed, whether the change is reversible or logged, and crucially, it doesn't explain output despite having an output schema (which does cover returns). The description adds moderate behavioral context but misses state-transition constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then structured parameter documentation. It's efficient for a 3-param tool, using clear labels and constraints. Slightly verbose in using an Args section for only 3 parameters, but overall tight with no wasted sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations but an output schema (which covers returns), the description provides the necessary parameter details and notes the new expiration requirement. However, it lacks behavioral context like permission needs, error conditions (e.g., reinstating an already-active acceptance), and sibling differentiation. Given the complexity and missing annotations, it's fairly complete but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does well: it names all three parameters, explains what each represents, specifies the format and future constraint for expiration_date (YYYY-MM-DD or ISO datetime, must be in the future), and marks reason as optional. This goes beyond the schema's bare type declarations. Minor gap: doesn't clarify the integer nature of risk_acceptance_id or whether it must reference an expired record.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (reinstate) and resource (expired risk acceptance) with scope qualifier (with a new expiration date). This clearly distinguishes it from siblings like expire_risk_acceptance, accept_risk, and update_risk_acceptance without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by saying 'expired risk acceptance' and requiring a future expiration date, which indicates when this tool applies. However, it doesn't explicitly contrast with alternatives like update_risk_acceptance or accept_risk, nor does it specify prerequisites (e.g., must the acceptance already be expired). Implicit guidance only.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.