DefectDojo MCP Server

by inspicereio.github.inspicere/mcp-defectdojov3.3.2

MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding

1Pythonstdioofficial registry

context tax

queued

security

queued

cold start

queued

freshness

Slowing4mo ago

Install DefectDojo MCP server

claude mcp add defectdojo -e DEFECTDOJO_URL='<defectdojo-url>' -e DEFECTDOJO_API_KEY='<defectdojo-api-key>' -e DEFECTDOJO_READ_API_KEY='<defectdojo-read-api-key>' -e DEFECTDOJO_WRITE_API_KEY='<defectdojo-write-api-key>' -e MCP_AUTH_TOKEN='<mcp-auth-token>' -e AUDIT_HMAC_KEY='<audit-hmac-key>' -- uvx mcp-defectdojo

{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<defectdojo-url>",
        "DEFECTDOJO_API_KEY": "<defectdojo-api-key>",
        "DEFECTDOJO_READ_API_KEY": "<defectdojo-read-api-key>",
        "DEFECTDOJO_WRITE_API_KEY": "<defectdojo-write-api-key>",
        "MCP_AUTH_TOKEN": "<mcp-auth-token>",
        "AUDIT_HMAC_KEY": "<audit-hmac-key>"
      }
    }
  }
}

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project).

{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<defectdojo-url>",
        "DEFECTDOJO_API_KEY": "<defectdojo-api-key>",
        "DEFECTDOJO_READ_API_KEY": "<defectdojo-read-api-key>",
        "DEFECTDOJO_WRITE_API_KEY": "<defectdojo-write-api-key>",
        "MCP_AUTH_TOKEN": "<mcp-auth-token>",
        "AUDIT_HMAC_KEY": "<audit-hmac-key>"
      }
    }
  }
}

Settings → Developer → Edit Config (claude_desktop_config.json), then restart.

{
  "servers": {
    "defectdojo": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<defectdojo-url>",
        "DEFECTDOJO_API_KEY": "<defectdojo-api-key>",
        "DEFECTDOJO_READ_API_KEY": "<defectdojo-read-api-key>",
        "DEFECTDOJO_WRITE_API_KEY": "<defectdojo-write-api-key>",
        "MCP_AUTH_TOKEN": "<mcp-auth-token>",
        "AUDIT_HMAC_KEY": "<audit-hmac-key>"
      }
    }
  }
}

Add to .vscode/mcp.json in your workspace.

{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<defectdojo-url>",
        "DEFECTDOJO_API_KEY": "<defectdojo-api-key>",
        "DEFECTDOJO_READ_API_KEY": "<defectdojo-read-api-key>",
        "DEFECTDOJO_WRITE_API_KEY": "<defectdojo-write-api-key>",
        "MCP_AUTH_TOKEN": "<mcp-auth-token>",
        "AUDIT_HMAC_KEY": "<audit-hmac-key>"
      }
    }
  }
}

Add to ~/.codeium/windsurf/mcp_config.json.

Configuration

Variable	Required	Secret	Description
DEFECTDOJO_URL	yes	—	Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)
DEFECTDOJO_API_KEY	yes	yes	API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.
DEFECTDOJO_READ_API_KEY	—	yes	Optional read-only API key (used for GET requests in dual-key mode)
DEFECTDOJO_WRITE_API_KEY	—	yes	Optional write API key (used for POST/PATCH in dual-key mode)
MCP_AUTH_TOKEN	—	yes	Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)
AUDIT_HMAC_KEY	—	yes	HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'

Freshness

Slowing — last maintenance signal 4mo ago. The newest of the signals below sets the band.

Last commit (default branch)
2026-05-28 · 4mo ago · GitHub
Latest release
no data · GitHub
Package published
no data · npm/PyPI
Registry entry updated
2026-05-28 · 5mo ago · official registry · v3.3.2

FAQ

›How do I install the DefectDojo MCP server in Claude Code?

Run: claude mcp add defectdojo -e DEFECTDOJO_URL='<defectdojo-url>' -e DEFECTDOJO_API_KEY='<defectdojo-api-key>' -e DEFECTDOJO_READ_API_KEY='<defectdojo-read-api-key>' -e DEFECTDOJO_WRITE_API_KEY='<defectdojo-write-api-key>' -e MCP_AUTH_TOKEN='<mcp-auth-token>' -e AUDIT_HMAC_KEY='<audit-hmac-key>' -- uvx mcp-defectdojo. For Cursor, VS Code, Claude Desktop and Windsurf, use the install tabs above.

›Does DefectDojo require an API key?

Yes. It expects DEFECTDOJO_URL, DEFECTDOJO_API_KEY, DEFECTDOJO_READ_API_KEY, DEFECTDOJO_WRITE_API_KEY, MCP_AUTH_TOKEN, AUDIT_HMAC_KEY, of which 5 are secrets.

›Can I use DefectDojo as a remote (hosted) MCP server?

No hosted endpoint is published; it runs locally over stdio.

›Is DefectDojo in the official MCP registry?

Yes, as io.github.inspicere/mcp-defectdojo.