DefectDojo MCP Server

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v1.0.0
Disambiguation5/5
Each tool has a clearly distinct purpose targeting specific resources and actions, such as create_engagement vs. update_engagement, and get_findings vs. search_findings, with no overlapping or ambiguous functions.
Naming Consistency5/5
All tool names follow a consistent verb_noun pattern using snake_case, such as create_engagement, list_products, and update_finding_status, with no deviations in style or convention.
Tool Count5/5
With 11 tools, the server is well-scoped for defect management, covering key operations like engagements, findings, and products without being overly sparse or bloated.
Completeness4/5
The tool set provides strong CRUD/lifecycle coverage for engagements and findings, including create, get, update, and list operations, though minor gaps like product creation or deletion might require workarounds.
Average 2.6/5 across 11 of 11 tools scored. Lowest: 1.5/5.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 0 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior1/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but offers none. It doesn't indicate whether this is a write operation, what permissions are required, whether it's idempotent, what happens on success/failure, or any rate limits. The description fails to add value beyond the implied 'create' action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness2/5
Is the description appropriately sized, front-loaded, and free of redundancy?
While concise with three words, the description is under-specified rather than efficiently informative. It lacks front-loaded critical information and wastes its brevity on stating the obvious. Every sentence should earn its place, but this single phrase adds minimal value beyond the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (9 parameters, 4 required), no annotations, 0% schema coverage, and presence of an output schema, the description is incomplete. It doesn't address the tool's purpose in context, parameter meanings, or behavioral traits, leaving significant gaps for a mutation tool in a security/finding management domain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 9 parameters with 0% description coverage, and the tool description provides no parameter information. It doesn't explain what 'cvssv3', 'cwe', 'severity', or other fields mean, their formats, or constraints (e.g., valid severity values). The description fails to compensate for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Create a new finding' is a tautology that restates the tool name without adding meaningful context. It specifies the verb 'create' and resource 'finding' but lacks specificity about what a 'finding' represents in this domain or how it differs from sibling tools like 'add_finding_note' or 'update_finding_status'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines1/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing test_id or engagement), exclusions, or relationships to sibling tools like 'add_finding_note' (for notes on existing findings) or 'update_finding_status' (for modifying findings).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior1/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. 'Create a new engagement' implies a write/mutation operation, but it doesn't describe what happens upon creation (e.g., whether it returns an ID, triggers notifications, or affects other resources), any authentication or permission requirements, rate limits, or error conditions. For a creation tool with 14 parameters and no annotation coverage, this is critically inadequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single three-word phrase—with no wasted words. It's front-loaded with the core action ('Create'), though this brevity comes at the cost of completeness. For conciseness alone, it scores perfectly as it says nothing unnecessary, but this doesn't imply quality in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness1/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (14 parameters, 5 required), lack of annotations, no output schema, and 0% schema description coverage, the description is completely inadequate. It doesn't explain what an engagement is, how to use the tool effectively, what parameters do, or what to expect upon success/failure. For a creation tool in a system with multiple engagement-related siblings, this leaves the agent with insufficient context to operate correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning none of the 14 parameters have descriptions in the schema. The tool description adds no information about what parameters like 'engagement_type', 'deduplication_on_engagement', or 'tags' mean, their expected formats, or how they influence the creation process. With many parameters and zero coverage, the description fails to compensate, leaving the agent to guess at semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Create a new engagement' is a tautology that merely restates the tool name without adding meaningful context. It doesn't specify what an 'engagement' is in this domain, what resources it involves, or how it differs from sibling tools like 'update_engagement' or 'close_engagement'. While it uses a clear verb ('create'), the resource ('engagement') remains undefined and indistinguishable from related operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines1/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a product_id or lead_id), when to choose 'create_engagement' over 'update_engagement' or 'close_engagement', or any constraints like permissions or timing. With multiple sibling tools for managing engagements, this lack of differentiation is a significant gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Close an engagement' implies a mutation, but it does not specify if this is reversible, what permissions are required, or any side effects like data archiving. This leaves critical behavioral traits undisclosed for a tool that likely alters state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence, 'Close an engagement', which is front-loaded and wastes no words. However, this brevity borders on under-specification, as it omits necessary details, though it is structurally efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool likely performs a mutation (closing an engagement) with no annotations, 0% schema coverage, and an output schema present (which may help), the description is incomplete. It does not address behavioral risks, parameter usage, or differentiation from siblings, failing to provide adequate context for safe and correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the undocumented parameter 'engagement_id'. However, it adds no meaning beyond the schema, failing to explain what an engagement ID is, how to obtain it, or its format, leaving the parameter's semantics unclear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Close an engagement' restates the tool name with minimal expansion, making it tautological. It specifies the verb 'close' and resource 'engagement' but lacks detail on what closing entails or how it differs from siblings like 'update_engagement' or 'get_engagement', leaving the purpose vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. With siblings like 'update_engagement' and 'get_engagement', the description does not indicate prerequisites, such as needing an existing engagement, or exclusions, like when not to close an engagement, offering minimal context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states this is an update operation, implying mutation, but doesn't disclose any behavioral traits such as required permissions, whether changes are reversible, rate limits, or what the response looks like. For a mutation tool with 14 parameters and no annotations, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with just four words, front-loaded with the core action. There's no wasted language, though this comes at the cost of completeness. Every word earns its place in conveying the basic purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (14 parameters, mutation operation, no annotations) and the presence of an output schema, the description is incomplete. It doesn't explain what an 'engagement' is in this context, what fields can be updated, or provide any behavioral context. The output schema helps with return values, but the description should do more for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate by explaining parameters. However, it provides no information about any of the 14 parameters, not even the required 'engagement_id'. This leaves the agent with no semantic understanding of what fields can be updated or their purposes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Update an existing engagement' clearly states the verb ('update') and resource ('engagement'), but it's vague about what specific aspects of an engagement can be updated. It doesn't distinguish this tool from sibling tools like 'close_engagement' or 'create_engagement' beyond the basic action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing engagement ID), when not to use it (e.g., for creating new engagements), or how it differs from sibling tools like 'close_engagement' or 'create_engagement'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('add') but doesn't cover permissions required, whether notes are editable/deletable, rate limits, or response behavior. For a mutation tool with zero annotation coverage, this leaves significant gaps in understanding how it behaves beyond the basic operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—'Add a note to a finding' is front-loaded and appropriately sized for the tool's apparent simplicity. Every word contributes directly to the core purpose without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which handles return values), low complexity (2 simple parameters), and no annotations, the description is minimally complete. It states what the tool does but lacks context on usage, behavioral traits, and parameter details, making it adequate only in a bare-bones sense with clear gaps for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for undocumented parameters. It mentions 'finding' and 'note' but adds minimal meaning beyond the schema's property names ('finding_id', 'note'). No details on parameter formats, constraints, or examples are provided, failing to adequately clarify semantics for the two required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Add a note to a finding' clearly states the action (add) and target resource (finding), but it's vague about what 'note' entails and doesn't distinguish from sibling tools like 'update_finding_status' or 'create_finding'. It avoids tautology by not just restating the name, but lacks specificity about the note's purpose or format.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing finding), exclusions, or compare to siblings like 'update_finding_status' for status changes. The description implies usage but offers no explicit context or decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It mentions 'filtering options and pagination support' which gives some context about capabilities, but doesn't describe what 'findings' represent in this domain, what permissions are needed, rate limits, error conditions, or what happens when filters return no results. For a tool with 5 parameters and no annotation coverage, this is inadequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that communicates the core functionality. It's appropriately sized for what it covers, though it could be more informative. There's no wasted verbiage or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there's an output schema (which presumably documents return values), the description doesn't need to explain return formats. However, for a tool with 5 parameters, 0% schema description coverage, and no annotations, the description should provide more context about what 'findings' are, how filtering works, and when to use this versus 'search_findings'. The current description is minimally adequate but leaves significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so all 5 parameters are undocumented in the schema. The description mentions 'filtering options' which hints at parameters like product_name, severity, and status, but doesn't explain what these filters mean, what values they accept, or their relationships. It also mentions 'pagination support' which hints at limit/offset, but doesn't explain default behaviors or constraints. The description adds minimal value beyond what's obvious from parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and resource 'findings', making the purpose understandable. However, it doesn't distinguish this tool from its sibling 'search_findings', which appears to serve a similar filtering function. The description is specific about what the tool does but lacks sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'search_findings' or 'list_engagements'. There's no mention of prerequisites, appropriate contexts, or exclusions. The agent must infer usage from the tool name and parameters alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. While it mentions filtering and pagination support, it doesn't describe important behavioral aspects like whether this is a read-only operation, what authentication is required, rate limits, what happens with invalid filters, or the structure of returned data. The description is minimal and leaves significant behavioral questions unanswered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just 8 words, front-loading the core purpose ('List engagements') followed by key capabilities. Every word earns its place, with no wasted language or redundancy. The structure moves from primary action to supporting features efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there's an output schema (which handles return values) and no annotations, the description provides the bare minimum for a listing tool. However, for a tool with 5 parameters and 0% schema description coverage, it should do more to explain filtering options and pagination behavior. The description is complete enough to understand the basic purpose but inadequate for optimal tool selection and usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and 5 parameters, the description provides minimal parameter information. It mentions 'optional filtering and pagination support' which hints at some parameters, but doesn't explain what specific filters are available (name, product_id, status) or how pagination works (limit, offset). The description doesn't adequately compensate for the complete lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('engagements'), making the purpose immediately understandable. It distinguishes from sibling tools like 'get_engagement' (singular) and 'create_engagement' by focusing on listing multiple items. However, it doesn't explicitly differentiate from 'search_findings' or 'list_products' in terms of resource scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'optional filtering and pagination support' which implies some usage context, but provides no explicit guidance on when to use this tool versus alternatives like 'search_findings' or 'get_engagement'. There's no mention of prerequisites, typical use cases, or when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. While it mentions filtering and pagination support, it doesn't describe important behaviors like whether this is a read-only operation, what permissions are required, rate limits, response format, or what happens when no products match filters. The description is insufficient for a tool with 4 parameters and no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('List all products') and adds key capabilities. Every word earns its place with no redundancy or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters with 0% schema coverage and no annotations, but with an output schema present, the description provides basic purpose but lacks sufficient detail about parameter usage, behavioral constraints, and operational context. The output schema reduces the need to describe return values, but the description should do more to compensate for the complete lack of schema descriptions and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'optional filtering and pagination support' which hints at the purpose of some parameters, but doesn't explain what 'prod_type' represents, what format 'name' filtering uses, or the relationship between limit/offset parameters. The description adds minimal value beyond the bare parameter names in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('products'), making the purpose immediately understandable. It distinguishes from siblings by focusing on product listing rather than engagement/finding operations, though it doesn't explicitly contrast with specific product-related alternatives that might exist.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'optional filtering and pagination support' which provides some context about when to use parameters, but offers no guidance on when to choose this tool versus alternatives like search_findings or other product-specific tools. No explicit when/when-not statements or sibling comparisons are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. It mentions 'pagination support' which is useful, but doesn't describe other critical behaviors: authentication requirements, rate limits, error conditions, or what the output contains. For a search tool with 6 parameters, this leaves significant gaps in understanding how it operates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just one sentence with zero wasted words. It's front-loaded with the core purpose and includes key behavioral information (pagination support) efficiently. Every element earns its place without redundancy or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 6 parameters with 0% schema description coverage and an output schema exists, the description is moderately complete. The output schema reduces the need to describe return values, but the description still lacks sufficient context about parameter usage, behavioral constraints, and differentiation from siblings. It's adequate but has clear gaps for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for undocumented parameters. It only mentions 'text query' and 'pagination support', which partially covers the 'query', 'limit', and 'offset' parameters. However, it doesn't address 'product_name', 'severity', or 'status' parameters at all, leaving half the parameters without semantic context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search for findings using a text query with pagination support'. It specifies the verb ('search'), resource ('findings'), and key features (text query, pagination). However, it doesn't explicitly differentiate from sibling tools like 'get_findings' or 'list_engagements', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'get_findings' and 'list_engagements' available, there's no indication of when this search tool is preferred over simpler retrieval tools or how it differs in functionality. The mention of 'pagination support' hints at use for large result sets but isn't explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but offers minimal information. It implies a read-only operation ('Get'), but doesn't specify permissions, rate limits, error handling, or what happens if the ID is invalid. For a tool with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It's front-loaded with the core action and resource, making it highly efficient and easy to parse for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one required parameter) and the presence of an output schema, the description is minimally adequate. However, with no annotations and incomplete parameter guidance, it lacks depth for safe and effective use, especially in a context with multiple sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'by ID', which adds context that the single parameter is an engagement identifier, but the schema already defines this as 'engagement_id' of type integer with 0% description coverage. This provides basic semantics but doesn't fully compensate for the lack of schema details, such as ID format or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Get') and resource ('engagement by ID'), making it immediately understandable. However, it doesn't differentiate from sibling tools like 'list_engagements' or 'create_engagement', which would require explicit comparison to earn a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention siblings like 'list_engagements' for multiple engagements or 'create_engagement' for new ones, nor does it specify prerequisites like needing a valid engagement ID. This leaves the agent without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states 'Update' which implies a mutation, but doesn't disclose critical traits: whether this requires specific permissions, if changes are reversible, what happens to associated data, or any rate limits. The description adds minimal behavioral context beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core action and lists all status options without unnecessary words. Every element (verb, resource, options) earns its place, making it highly concise and well-structured for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a mutation tool with 2 parameters, 0% schema coverage, no annotations, but an output schema exists, the description is minimally adequate. It covers the purpose and status values, but lacks behavioral details (e.g., permissions, side effects) and parameter semantics for 'finding_id'. The output schema reduces the need to explain return values, but more context would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema provides no parameter descriptions. The description lists the status options, which adds meaning for the 'status' parameter beyond the schema's basic type. However, it doesn't explain 'finding_id' (e.g., how to obtain it) or provide format details for either parameter. It partially compensates for the coverage gap but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Update' and the resource 'status of a finding', specifying the exact status options (Active, Verified, False Positive, Mitigated, Inactive). It distinguishes from siblings like 'create_finding' or 'get_findings' by focusing on status modification rather than creation or retrieval. However, it doesn't explicitly differentiate from other update tools like 'update_engagement' beyond the resource name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing finding ID), when not to use it (e.g., for other finding attributes), or refer to sibling tools like 'add_finding_note' for related actions. Usage is implied by the action but not explicitly contextualized.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![defectdojo-mcp MCP server](https://glama.ai/mcp/servers/jamiesonio/defectdojo-mcp/badges/card.svg)](https://glama.ai/mcp/servers/jamiesonio/defectdojo-mcp)

Score Badge

Copy to your README.md:

[![defectdojo-mcp MCP server](https://glama.ai/mcp/servers/jamiesonio/defectdojo-mcp/badges/score.svg)](https://glama.ai/mcp/servers/jamiesonio/defectdojo-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jamiesonio/defectdojo-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server