DefectDojo runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 11 Nov 2026.
Search, triage and import findings in DefectDojo through its REST API v2.
Nothing serious here today
Today is the operative word: we check DefectDojo every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add defectdojo-mcp -e 'DEFECTDOJO_URL=<DEFECTDOJO_URL>' -e 'DEFECTDOJO_API_KEY=<DEFECTDOJO_API_KEY>' -- uvx defectdojo-mcp-server{
"mcpServers": {
"defectdojo-mcp": {
"command": "uvx",
"args": [
"defectdojo-mcp-server"
],
"env": {
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
}
}
}
}[mcp_servers.defectdojo-mcp]
command = "uvx"
args = ["defectdojo-mcp-server"]
env = { DEFECTDOJO_URL = "<DEFECTDOJO_URL>", DEFECTDOJO_API_KEY = "<DEFECTDOJO_API_KEY>" }{
"mcpServers": {
"defectdojo-mcp": {
"command": "uvx",
"args": [
"defectdojo-mcp-server"
],
"env": {
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
}
}
}
}{
"servers": {
"defectdojo-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"defectdojo-mcp-server"
],
"env": {
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
}
}
}
}Put your own values in place of
<DEFECTDOJO_URL> (Base URL of your DefectDojo instance, for example https://defectdojo.example.com), <DEFECTDOJO_API_KEY> (DefectDojo API v2 key).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
DEFECTDOJO_ALLOW_WRITES (Set to true to enable write tools. Read-only by default), DEFECTDOJO_VERIFY_SSL (true, false, or a path to a CA bundle), DEFECTDOJO_IMPORT_DIRS (Folders that scan reports may be read from for imports).
Alternatives to DefectDojo
same job, measured the same wayMCP server for SecObserve: triage findings, import scan reports and SBOMs, generate VEX.
Web, local, news, image, and video search through the Brave Search API.
Set up a brand, read its AI-search visibility, and act on diagnostic findings.
Read-only MCP server for DefectDojo Community Edition: triage findings, grouped across products.
Web search through DuckDuckGo and readable page fetching, no API key needed.
Perplexity answers: ask, search, reason, and deep research through the Sonar API.
Search Google Flights through SerpApi: one-way and round-trip flights by IATA airport code.
Google Image Search: Fast and Simple Google Images Search API. You can get 100+ search results in.
DefectDojo — questions
Answers built from our own checks of this server.