DefectDojo MCP Server

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add mcp-defectdojo -- uvx mcp-defectdojo

{
  "mcpServers": {
    "mcp-defectdojo": {
      "args": [
        "mcp-defectdojo"
      ],
      "command": "uvx"
    }
  }
}

[mcp_servers.mcp-defectdojo]
command = "uvx"
args = ["mcp-defectdojo"]

{
  "mcpServers": {
    "mcp-defectdojo": {
      "args": [
        "mcp-defectdojo"
      ],
      "command": "uvx"
    }
  }
}

{
  "mcpServers": {
    "mcp-defectdojo": {
      "args": [
        "mcp-defectdojo"
      ],
      "command": "uvx"
    }
  }
}

This one needs environment variables set before it will start: DEFECTDOJO_URL (Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)), DEFECTDOJO_API_KEY (API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.), DEFECTDOJO_READ_API_KEY (Optional read-only API key (used for GET requests in dual-key mode)), DEFECTDOJO_WRITE_API_KEY (Optional write API key (used for POST/PATCH in dual-key mode)), MCP_AUTH_TOKEN (Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)), AUDIT_HMAC_KEY (HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'). The author declared them in the registry entry; get the values from the project itself.