Skip to main content
Glama
dcianciulli

DefectDojo MCP Server

by dcianciulli

update_risk_acceptance

Update an existing risk acceptance in DefectDojo to extend its expiration date or change decision and recommendation details.

Instructions

Update a risk acceptance (partial update, e.g. extend expiration).

Args: risk_acceptance_id: The risk acceptance ID expiration_date: New expiration date (YYYY-MM-DD or ISO datetime) decision: Risk treatment decision code (A, V, M, F, T) decision_details: Details about the decision recommendation: Security recommendation code (A, V, M, F, T) recommendation_details: Details about the recommendation reactivate_expired: Reactivate findings on expiration restart_sla_expired: Restart SLA on expiration

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
decisionNo
recommendationNo
expiration_dateNo
decision_detailsNo
reactivate_expiredNo
risk_acceptance_idYes
restart_sla_expiredNo
recommendation_detailsNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. 'Partial update' is a genuine disclosure that unspecified fields are preserved, which is valuable. However, it says nothing about required permissions, whether the change is reversible, or the side effects implied by reactivate_expired/restart_sla_expired flags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-sentence summary followed by a compact Args list. Given 0% schema coverage, enumerating the parameters is justified rather than redundant, and there is little obvious waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described. The parameter documentation is adequate, but for a mutation tool with no annotations and a crowded sibling set it stops short on authorization context and usage routing, leaving an agent under-informed about when and how safely to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it largely does: it documents all 8 parameters, gives the allowed decision/recommendation codes (A, V, M, F, T), and specifies the expiration_date format. This adds substantial meaning the raw schema lacks, though the A/V/M/F/T codes themselves remain unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'Update' plus resource 'risk acceptance', and it explicitly flags that this is a partial update. It distinguishes itself from list/get/create/delete_risk_acceptance by virtue of the verb, but does not name any sibling to differentiate from the closely-related expire/reinstate/accept tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical 'e.g. extend expiration' hints at a use case, but there is no guidance on when to choose this over the many adjacent siblings such as expire_risk_acceptance, reinstate_risk_acceptance, or accept_risk. An agent must infer routing entirely on its own.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.