defaudit-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| DEFAUDIT_URL | Yes | The base URL of your DefAudit installation, e.g. https://defaudit.example.com | |
| DEFAUDIT_TIMEOUT | No | HTTP timeout in seconds. | 30 |
| DEFAUDIT_APP_TOKEN | Yes | Personal app token from DefAudit (Settings → Profile → Personal app token). Acts as its owner. | |
| DEFAUDIT_VERIFY_TLS | No | Set to 'false' only for a trusted development instance using a self-signed certificate. | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_projectsA | List active DefAudit projects and their most recent scan. |
| start_scanA | Start a security scan for an existing project. Omit branch to use the project default. |
| list_scansA | List recent scans for a project. Limit must be between 1 and 100. |
| get_scanB | Read scan status, progress, timestamps, and severity summary. |
| get_scan_resultsA | Read completed scan findings, including each finding's false-positive status. |
| mark_false_positiveB | Mark a finding and matching findings in the project as false positives. A reason is required. |
| unmark_false_positiveA | Remove the false-positive flag from a finding and matching findings in the project. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct action and resource: projects vs scans vs findings, with clear separation of listing, starting, reading status/results, and managing false positives. No overlap or ambiguity.
All tool names follow a consistent verb_noun pattern using snake_case (e.g., list_projects, start_scan, mark_false_positive). The pattern is uniform and predictable.
Seven tools cover the core scanning and false-positive management workflow without unnecessary bloat. The set is well-scoped for a security audit MCP server.
The surface covers project listing, scan initiation/status/results, and false-positive toggling. Minor gaps exist (e.g., no stop_scan or project creation), but the primary workflows are complete and no critical dead ends.