DefectDojo

by jamiesonio

1 1.5k downloads Not rated yet MIT

GitHub

About

Bridges to the DefectDojo vulnerability management system, enabling interaction with security findings, products, and engagements for streamlined security workflow integration.

Details

Repository: jamiesonio/defectdojo-mcp
License: MIT

Explore

This MCP server exposes tools for managing key DefectDojo entities:

Findings: Fetch, search, create, update status, and add notes.
Products: List available products.

Engagements: List, retrieve details, create, update, and close engagements.

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below
Plugin Name DefectDojo

Command (node, npx, python, etc.) uvx
Arguments
- Argument 1 defectdojo-mcp
Environment
- DEFECTDOJO_API_BASE https://your-defectdojo-instance.com
- DEFECTDOJO_API_TOKEN YOUR_API_TOKEN_HERE
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "/c",
                "defectdojo-mcp"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "/c",
                "defectdojo-mcp"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "/c",
                "defectdojo-mcp"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "/c",
                "defectdojo-mcp"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "/c",
                "defectdojo-mcp"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

From the repository

The server requires the following environment variables to connect to your DefectDojo instance:

DEFECTDOJO_API_TOKEN (required): Your DefectDojo API token for authentication.
DEFECTDOJO_API_BASE (required): The base URL of your DefectDojo instance (e.g., https://your-defectdojo-instance.com).

You can configure these in your MCP client's settings file. Here's an example using the uvx command:

{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": ["defectdojo-mcp"],
      "env": {
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE",
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com"
      }
    }
  }
}

If you installed the package using pip, the configuration would look like this:

{
  "mcpServers": {
    "defectdojo": {
      "command": "defectdojo-mcp",
      "args": [],
      "env": {
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE",
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com"
      }
    }
  }
}

There are a couple of ways to run this server:

pip install .

(Note: These examples assume an MCP client environment capable of calling use_mcp_tool)

`get_findings`

Retrieve findings with filtering options for product_name, status, and severity, as well as pagination parameters like limit and offset.

`search_findings`

Search findings using a text query, with additional filtering and pagination options.

`update_finding_status`

Change the status of a specific finding (e.g., Active, Verified, False Positive) by providing the finding ID and the new status.

`add_finding_note`

Add a textual note to a finding by specifying the finding ID and the note content.

`create_finding`

Create a new finding associated with a test by providing the title, test_id, severity, description, and cwe.

`list_products`

List products with optional filtering by name and pagination parameters.

`list_engagements`

List engagements with filtering options for product_id, status, and name, along with pagination.

`get_engagement`

Get details for a specific engagement by providing its ID.

`create_engagement`

Create a new engagement for a product by providing product_id, name, target_start, target_end, and status.

`update_engagement`

Modify details of an existing engagement by providing the engagement ID and the details to update.

`close_engagement`

Mark an engagement as completed by providing its engagement ID.

The following tools are available via the MCP interface:

get_findings: Retrieve findings with filtering (product_name, status, severity) and pagination (limit, offset).
search_findings: Search findings using a text query, with filtering and pagination.
update_finding_status: Change the status of a specific finding (e.g., Active, Verified, False Positive).
add_finding_note: Add a textual note to a finding.
create_finding: Create a new finding associated with a test.
list_products: List products with filtering (name, prod_type) and pagination.
list_engagements: List engagements with filtering (product_id, status, name) and pagination.
get_engagement: Get details for a specific engagement by its ID.
create_engagement: Create a new engagement for a product.
update_engagement: Modify details of an existing engagement.
close_engagement: Mark an engagement as completed.

(See the original README content below for detailed usage examples of each tool)*

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "defectdojo": {
            "env": {
                "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
                "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
            },
            "args": [
                "defectdojo-mcp"
            ],
            "command": "uvx"
        }
    }
}

Linux

{
    "env": {
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
    },
    "args": [
        "defectdojo-mcp"
    ],
    "command": "uvx"
}

Macos

{
    "env": {
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
    },
    "args": [
        "defectdojo-mcp"
    ],
    "command": "uvx"
}

Windows

{
    "env": {
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com",
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE"
    },
    "args": [
        "/c",
        "defectdojo-mcp"
    ],
    "command": "cmd"
}

This project provides a Model Context Protocol (MCP) server implementation for DefectDojo, a popular open-source vulnerability management tool. It allows AI agents and other MCP clients to interact with the DefectDojo API programmatically.

Features

This MCP server exposes tools for managing key DefectDojo entities:

Findings: Fetch, search, create, update status, and add notes.
Products: List available products.

Engagements: List, retrieve details, create, update, and close engagements.

Installation & Running

There are a couple of ways to run this server:

Using `uvx` (Recommended)

uvx executes Python applications in temporary virtual environments, installing dependencies automatically.

uvx defectdojo-mcp

Using `pip`

You can install the package into your Python environment using pip.

```bash

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Explore

Setting up with Highlight

From the repository

get_findings

search_findings

update_finding_status

add_finding_note

create_finding

list_products

list_engagements

get_engagement

create_engagement

update_engagement

close_engagement

Claude Desktop / Cursor

Linux

Macos

Windows

Features

Installation & Running

Using uvx (Recommended)

Using pip

More like this

Time

Sentry

Github

Git

`get_findings`

`search_findings`

`update_finding_status`

`add_finding_note`

`create_finding`

`list_products`

`list_engagements`

`get_engagement`

`create_engagement`

`update_engagement`

`close_engagement`

Using `uvx` (Recommended)

Using `pip`