Skip to main content
Glama
jamiesonio

DefectDojo MCP Server

by jamiesonio

get_findings

Retrieve vulnerabilities with customizable filters, pagination, and sorting using the DefectDojo MCP Server for efficient vulnerability management.

Instructions

Get findings with filtering options and pagination support

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
offsetNo
product_nameNo
severityNo
statusNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Implementation Reference

  • The handler function for the 'get_findings' MCP tool. It processes input parameters into filters, calls the DefectDojo client to fetch findings, and formats the response with status and data/error handling.
    async def get_findings(product_name: Optional[str] = None, status: Optional[str] = None,
                           severity: Optional[str] = None, limit: int = 20,
                           offset: int = 0) -> Dict[str, Any]:
        """Get findings with optional filters and pagination.
    
        Args:
            product_name: Optional product name filter
            status: Optional status filter
            severity: Optional severity filter
            limit: Maximum number of findings to return per page (default: 20)
            offset: Number of records to skip (default: 0)
    
        Returns:
            Dictionary with status, data/error, and pagination metadata
        """
        filters = {}
        if product_name:
            filters["product_name"] = product_name
        if status:
            filters["status"] = status
        if severity:
            filters["severity"] = severity
        if limit:
            filters["limit"] = limit
        if offset:
            filters["offset"] = offset
    
        client = get_client()
        result = await client.get_findings(filters)
    
        if "error" in result:
            return {"status": "error", "error": result["error"], "details": result.get("details", "")}
    
        return {"status": "success", "data": result}
  • Registration of the 'get_findings' tool with the MCP server using mcp.tool decorator, specifying name and description, and binding the handler function.
    mcp.tool(
        name="get_findings",
        description="Get findings with filtering options and pagination support"
    )(get_findings)
  • Helper method in DefectDojoClient that performs the actual API request to retrieve findings, called by the tool handler.
    async def get_findings(self, filters: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
        """Get findings with optional filters."""
        return await self._request("GET", "/api/v2/findings/", params=filters)
  • Alternative or module-level registration function for finding tools, including 'get_findings', though the main registration is in tools.py.
    def register_tools(mcp):
        """Register finding-related tools with the MCP server instance."""
        mcp.tool(name="get_findings", description="Get findings with filtering options and pagination support")(get_findings)
        mcp.tool(name="search_findings", description="Search for findings using a text query with pagination support")(search_findings)
        mcp.tool(name="update_finding_status", description="Update the status of a finding (Active, Verified, False Positive, Mitigated, Inactive)")(update_finding_status)
        mcp.tool(name="add_finding_note", description="Add a note to a finding")(add_finding_note)
        mcp.tool(name="create_finding", description="Create a new finding")(create_finding)
    
    
    async def search_findings(query: str, product_name: Optional[str] = None,
                             status: Optional[str] = None, severity: Optional[str] = None,
                             limit: int = 20, offset: int = 0) -> Dict[str, Any]:
        """Search for findings using a text query with pagination.
    
        Args:
            query: Text to search for in findings
            product_name: Optional product name filter
            status: Optional status filter
            severity: Optional severity filter
            limit: Maximum number of findings to return per page (default: 20)
            offset: Number of records to skip (default: 0)
    
        Returns:
            Dictionary with status, data/error, and pagination metadata
        """
        filters = {}
        if product_name:
            filters["product_name"] = product_name
        if status:
            filters["status"] = status
        if severity:
            filters["severity"] = severity
        if limit:
            filters["limit"] = limit
        if offset:
            filters["offset"] = offset
    
        client = get_client()
        result = await client.search_findings(query, filters)
    
        if "error" in result:
            return {"status": "error", "error": result["error"], "details": result.get("details", "")}
    
        return {"status": "success", "data": result}
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It mentions 'filtering options and pagination support' which gives some context about capabilities, but doesn't describe what 'findings' represent in this domain, what permissions are needed, rate limits, error conditions, or what happens when filters return no results. For a tool with 5 parameters and no annotation coverage, this is inadequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that communicates the core functionality. It's appropriately sized for what it covers, though it could be more informative. There's no wasted verbiage or unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there's an output schema (which presumably documents return values), the description doesn't need to explain return formats. However, for a tool with 5 parameters, 0% schema description coverage, and no annotations, the description should provide more context about what 'findings' are, how filtering works, and when to use this versus 'search_findings'. The current description is minimally adequate but leaves significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so all 5 parameters are undocumented in the schema. The description mentions 'filtering options' which hints at parameters like product_name, severity, and status, but doesn't explain what these filters mean, what values they accept, or their relationships. It also mentions 'pagination support' which hints at limit/offset, but doesn't explain default behaviors or constraints. The description adds minimal value beyond what's obvious from parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and resource 'findings', making the purpose understandable. However, it doesn't distinguish this tool from its sibling 'search_findings', which appears to serve a similar filtering function. The description is specific about what the tool does but lacks sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'search_findings' or 'list_engagements'. There's no mention of prerequisites, appropriate contexts, or exclusions. The agent must infer usage from the tool name and parameters alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Related Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jamiesonio/defectdojo-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server