DefectDojo MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| DEFECTDOJO_URL | Yes | Base URL of your DefectDojo instance | |
| DEFECTDOJO_API_KEY | Yes | DefectDojo API v2 token (DefectDojo → user menu → API v2 Key) | |
| DEFECTDOJO_VERIFY_TLS | No | Set to false to skip TLS verification. Discouraged; only for self-signed certs. | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| health_checkA | Verify connectivity and auth to DefectDojo. Returns the instance URL and product count. |
| list_productsA | List all DefectDojo products (each product is typically one repo or service). |
| list_critical_findingsA | List actionable CRITICAL findings (active, not false-positive/risk-accepted/mitigated). Optionally scope to one product. Set include_duplicates=True to also see duplicates. |
| list_findings_by_severityC | List actionable findings of a given severity (Critical, High, Medium, Low or Info). |
| group_critical_by_vulnA | Group actionable CRITICAL findings across every product by unique vulnerability. Keyed on CVE where present, else CWE plus title. Useful for filing one tracker issue per vulnerability that lists every affected product. Widest blast radius first. |
| list_duplicate_findingsB | List findings DefectDojo has marked as duplicates, optionally scoped to one product. |
| get_findingB | Full detail for one finding: description, mitigation, references, CWE/CVE and location. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Several tools overlap around finding listing: list_critical_findings is essentially a specialized case of list_findings_by_severity for Critical severity, and it also has an include_duplicates option that overlaps with list_duplicate_findings. Descriptions clarify intent somewhat, but an agent could reasonably hesitate between these tools when triaging critical or duplicate findings.
Most tools follow a clear snake_case verb_noun pattern, especially the list_* and get_* tools. Minor deviations like group_critical_by_vuln using an abbreviation and health_check being a noun-like operation keep it from being fully uniform, but the convention is still predictable.
Seven tools is well-scoped for a focused DefectDojo MCP server, with each tool earning its place in a read-only triage workflow. The set is neither thin nor bloated.
The surface covers critical/severity/duplicate finding listing, grouping, detail, products, and health, which supports core triage. However, it lacks a general findings query with product plus severity filters, product detail, and any update/mitigation workflow, creating notable gaps for agents that need more than high-level read-only inspection.