DefectDojo MCP Server

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add mcp-defectdojo -e 'DEFECTDOJO_URL=<DEFECTDOJO_URL>' -e 'DEFECTDOJO_API_KEY=<DEFECTDOJO_API_KEY>' -- uvx mcp-defectdojo

{
  "mcpServers": {
    "mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
      }
    }
  }
}

[mcp_servers.mcp-defectdojo]
command = "uvx"
args = ["mcp-defectdojo"]
env = { DEFECTDOJO_URL = "<DEFECTDOJO_URL>", DEFECTDOJO_API_KEY = "<DEFECTDOJO_API_KEY>" }

{
  "mcpServers": {
    "mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
      }
    }
  }
}

{
  "servers": {
    "mcp-defectdojo": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
      }
    }
  }
}

Put your own values in place of <DEFECTDOJO_URL> (Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)), <DEFECTDOJO_API_KEY> (API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode). The author’s registry entry marks them as required.

Optional settings from the registry entry, left out of the block above: DEFECTDOJO_READ_API_KEY (Optional read-only API key (used for GET requests in dual-key mode)), DEFECTDOJO_WRITE_API_KEY (Optional write API key (used for POST/PATCH in dual-key mode)), MCP_AUTH_TOKEN (Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)), AUDIT_HMAC_KEY (HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))').