DefectDojo MCP Server

Instructions

Implementation Reference

• src/defectdojo/findings_tools.py:173-233 (handler)

  The main handler function for the 'create_finding' tool. It validates inputs, constructs the data payload, calls the DefectDojo client to create the finding, and returns the result.

  async def create_finding(title: str, test_id: int, severity: str, description: str,
                          cwe: Optional[int] = None, cvssv3: Optional[str] = None,
                          mitigation: Optional[str] = None, impact: Optional[str] = None,
                          steps_to_reproduce: Optional[str] = None) -> Dict[str, Any]:
      """Create a new finding.
  
      Args:
          title: Title of the finding
          test_id: ID of the test to associate the finding with
          severity: Severity level (Critical, High, Medium, Low, Info)
          description: Description of the finding
          cwe: Optional CWE identifier
          cvssv3: Optional CVSS v3 score string
          mitigation: Optional mitigation steps
          impact: Optional impact description
          steps_to_reproduce: Optional steps to reproduce
  
      Returns:
          Dictionary with status and data/error
      """
      # Validate severity (case-insensitive check, but send capitalized)
      valid_severities = ["critical", "high", "medium", "low", "info"]
      normalized_severity = severity.lower()
      if normalized_severity not in valid_severities:
          # Use title case for user-facing error message
          valid_display = [s.title() for s in valid_severities]
          return {"status": "error", "error": f"Invalid severity '{severity}'. Must be one of: {', '.join(valid_display)}"}
  
      # Use title case for API
      api_severity = severity.title()
  
      data = {
          "title": title,
          "test": test_id,
          "severity": api_severity,
          "description": description,
          # Set defaults expected by API if not provided explicitly by user?
          # e.g., "active": True, "verified": False? Check API docs.
          "active": True,
          "verified": False,
      }
  
      # Add optional fields if provided
      if cwe is not None:
          data["cwe"] = cwe
      if cvssv3:
          data["cvssv3"] = cvssv3 # Assuming API accepts the string directly
      if mitigation:
          data["mitigation"] = mitigation
      if impact:
          data["impact"] = impact
      if steps_to_reproduce:
          data["steps_to_reproduce"] = steps_to_reproduce
  
      client = get_client()
      result = await client.create_finding(data)
  
      if "error" in result:
          return {"status": "error", "error": result["error"], "details": result.get("details", "")}
  
      return {"status": "success", "data": result}

• src/defectdojo/tools.py:52-56 (registration)

  Registers the 'create_finding' tool with the FastMCP server instance, importing the handler from findings_tools.py.

  mcp.tool(
      name="create_finding",
      description="Create a new finding"
  )(create_finding)

• src/defectdojo/client.py:62-64 (helper)

  The DefectDojoClient method called by the tool handler to perform the actual API POST request to create a finding.

  async def create_finding(self, data: Dict[str, Any]) -> Dict[str, Any]:
      """Create a new finding."""
      return await self._request("POST", "/api/v2/findings/", json=data)

• src/defectdojo/findings_tools.py:50-50 (registration)

  Alternative registration of the 'create_finding' tool within the findings_tools module's register_tools function.

  mcp.tool(name="create_finding", description="Create a new finding")(create_finding)

• src/defectdojo/findings_tools.py:173-176 (schema)

  Input schema defined by the function type hints and docstring parameters for the create_finding tool.

  async def create_finding(title: str, test_id: int, severity: str, description: str,
                          cwe: Optional[int] = None, cvssv3: Optional[str] = None,
                          mitigation: Optional[str] = None, impact: Optional[str] = None,
                          steps_to_reproduce: Optional[str] = None) -> Dict[str, Any]: