DefectDojo Community runs on your own machine — the client starts it, so there is no endpoint to ping. 1 092 installs a week from pypi. Last commit 6 Nov 2026.
Read-only MCP server for DefectDojo Community Edition: triage findings, grouped across products.
Nothing serious here today
Today is the operative word: we check DefectDojo Community every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add defectdojo-community-mcp -e 'DEFECTDOJO_URL=<DEFECTDOJO_URL>' -e 'DEFECTDOJO_API_KEY=<DEFECTDOJO_API_KEY>' -- uvx defectdojo-community-mcp{
"mcpServers": {
"defectdojo-community-mcp": {
"command": "uvx",
"args": [
"defectdojo-community-mcp"
],
"env": {
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
}
}
}
}[mcp_servers.defectdojo-community-mcp]
command = "uvx"
args = ["defectdojo-community-mcp"]
env = { DEFECTDOJO_URL = "<DEFECTDOJO_URL>", DEFECTDOJO_API_KEY = "<DEFECTDOJO_API_KEY>" }{
"mcpServers": {
"defectdojo-community-mcp": {
"command": "uvx",
"args": [
"defectdojo-community-mcp"
],
"env": {
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
}
}
}
}{
"servers": {
"defectdojo-community-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"defectdojo-community-mcp"
],
"env": {
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>"
}
}
}
}Put your own values in place of
<DEFECTDOJO_URL> (Base URL of your DefectDojo instance, e.g. https://defectdojo.example.com (no trailing /api/v2)), <DEFECTDOJO_API_KEY> (DefectDojo API v2 token. Use a dedicated read-only user: this server never needs write access).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
DEFECTDOJO_VERIFY_TLS (Set to false to skip TLS certificate verification. Discouraged; see SECURITY.md), DEFECTDOJO_TIMEOUT_SECONDS (Per-request HTTP timeout in seconds. Defaults to 30).
Alternatives to DefectDojo Community
same job, measured the same wayMCP server for OpenProject Community Edition with guarded read/write support.
Production-grade PostgreSQL MCP server — 279 tools for query, tuning & ops, read-only by default.
Read-only MCP access to The Agent Commons: shared security findings for AI agents and their tools.
Read-only MCP server for WordPress + WooCommerce products, orders, sales, and posts.
A security-focused MCP server for self-hosted n8n Community Edition.
Read-only, sourced access facts for wealth tech products, vendor MCP servers and Form ADV columns.
MCP server for Microsoft Entra ID sign-in and audit-log triage (read-only by default)
Read-only DWG file access for AI clients through MCP.
DefectDojo Community — questions
Answers built from our own checks of this server.