DefectDojo
About
Bridges to the DefectDojo vulnerability management system, enabling interaction with security findings, products, and engagements for streamlined security workflow integration.
Details
- Author
- jamiesonio
- Repository
- jamiesonio/defectdojo-mcp
- GitHub stars
- 1
- Downloads
- 1,535
- License
- MIT License
- Categories
- Productivity, Developer Tools, Design, Workplace, AI, Search, Security, Frontend
Jump to
This MCP server exposes tools for managing key DefectDojo entities:
Findings: Fetch, search, create, update status, and add notes.
Products: List available products.
- Engagements: List, retrieve details, create, update, and close engagements.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
DefectDojoCommand (node, npx, python, etc.)uvxArguments-
Argument 1
defectdojo-mcp
Environment-
DEFECTDOJO_API_BASE
https://your-defectdojo-instance.com -
DEFECTDOJO_API_TOKEN
YOUR_API_TOKEN_HERE
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
-
Argument 1
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
1. Clone the repository.
2. It's recommended to use a virtual environment:
python -m venv .venv
source .venv/bin/activate # On Windows use .venv\Scripts\activate
3. Install dependencies, including development dependencies:
pip install -e ".[dev]"
There are a couple of ways to run this server:
pip install .
(Note: These examples assume an MCP client environment capable of calling use_mcp_tool)
get_findings
Retrieve findings with filtering options for product_name, status, and severity, as well as pagination parameters like limit and offset.
search_findings
Search findings using a text query, with additional filtering and pagination options.
update_finding_status
Change the status of a specific finding (e.g., Active, Verified, False Positive) by providing the finding ID and the new status.
add_finding_note
Add a textual note to a finding by specifying the finding ID and the note content.
create_finding
Create a new finding associated with a test by providing the title, test_id, severity, description, and cwe.
list_products
List products with optional filtering by name and pagination parameters.
list_engagements
List engagements with filtering options for product_id, status, and name, along with pagination.
get_engagement
Get details for a specific engagement by providing its ID.
create_engagement
Create a new engagement for a product by providing product_id, name, target_start, target_end, and status.
update_engagement
Modify details of an existing engagement by providing the engagement ID and the details to update.
close_engagement
Mark an engagement as completed by providing its engagement ID.
The following tools are available via the MCP interface:
get_findings: Retrieve findings with filtering (product_name, status, severity) and pagination (limit, offset).
search_findings: Search findings using a text query, with filtering and pagination.
update_finding_status: Change the status of a specific finding (e.g., Active, Verified, False Positive).
add_finding_note: Add a textual note to a finding.
create_finding: Create a new finding associated with a test.
list_products: List products with filtering (name, prod_type) and pagination.
list_engagements: List engagements with filtering (product_id, status, name) and pagination.
get_engagement: Get details for a specific engagement by its ID.
create_engagement: Create a new engagement for a product.
update_engagement: Modify details of an existing engagement.
close_engagement: Mark an engagement as completed.
(See the original README content below for detailed usage examples of each tool)*
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"defectdojo": {
"env": {
"DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
"DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
},
"args": [
"defectdojo-mcp"
],
"command": "uvx"
}
}
}Linux
{
"env": {
"DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
"DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
},
"args": [
"defectdojo-mcp"
],
"command": "uvx"
}Macos
{
"env": {
"DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
"DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
},
"args": [
"defectdojo-mcp"
],
"command": "uvx"
}Windows
{
"env": {
"DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
"DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
},
"args": [
"/c",
"defectdojo-mcp"
],
"command": "cmd"
}DefectDojo MCP Server
<!-- Add this badge if/when published to PyPI -->
This project provides a Model Context Protocol (MCP) server implementation for DefectDojo, a popular open-source vulnerability management tool. It allows AI agents and other MCP clients to interact with the DefectDojo API programmatically.
Features
This MCP server exposes tools for managing key DefectDojo entities:
Findings: Fetch, search, create, update status, and add notes.
Products: List available products.
- Engagements: List, retrieve details, create, update, and close engagements.
Installation & Running
There are a couple of ways to run this server:
Using uvx (Recommended)
uvx executes Python applications in temporary virtual environments, installing dependencies automatically.
uvx defectdojo-mcp
Using pip
You can install the package into your Python environment using pip.
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
