DefectDojo
Let your coding agent query and update DefectDojo findings, products, and engagements through 24 RBAC-aware tools.
Overview
DefectDojo MCP is a Ship-phase MCP server that exposes 24 RBAC-guarded tools to manage vulnerabilities and engagements in DefectDojo from your coding agent.
What is this MCP server?
- 24 MCP tools against DefectDojo API v2 with role-based access control
- HMAC audit chain and optional SIEM forwarding for enterprise-grade traceability
- Dual-key mode: DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least privilege
- PyPI package mcp-defectdojo v3.3.2 with uvx runtime hint
- HTTPS-enforced DEFECTDOJO_URL (ALLOW_INSECURE_HTTP escape hatch documented)
- 24 MCP tools documented in server title/description
- Server version 3.3.2 on PyPI identifier mcp-defectdojo
- stdio transport with uvx runtime hint
What problem does it solve?
Vulnerability data lives in DefectDojo while your agent works in the IDE, so triage and updates stall without an API bridge.
Who is it for?
Solo builders or tiny teams with an existing DefectDojo instance who want agent-driven finding triage and engagement updates.
Skip if: Anyone without DefectDojo installed who only needs a lightweight local security checklist.
What do I get? / Deliverables
Your agent can read and write DefectDojo records under least-privilege keys with auditable tool access aligned to your instance RBAC.
- Agent-driven queries and updates on DefectDojo findings and related objects
- Audit-chain-backed MCP actions when HMAC and SIEM options are enabled
Recommended MCP Servers
Journey fit
How it compares
DefectDojo API integration with 24 tools, not a standalone vulnerability scanner or Inkog-style pre-install MCP audit.
Common Questions / FAQ
Who is DefectDojo MCP for?
Developers and indie security leads who already use DefectDojo and want MCP-driven triage, reporting, and updates from Claude Code or similar agents.
When should I use DefectDojo MCP?
Use it in Ship security when consolidating scan results, tracking remediation before release, or automating DefectDojo workflows during code review.
How do I add DefectDojo MCP to my agent?
Run mcp-defectdojo via uvx from PyPI, set DEFECTDOJO_URL and DEFECTDOJO_API_KEY (or read/write split keys), then register the stdio server in your MCP client.