MCP Server

DefectDojo MCP Server

Name: DefectDojo MCP Server
Author: io.github.inspicere

io.github.inspicere/mcp-defectdojo

Repository Registry

What is the DefectDojo MCP server?

MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding

How to install DefectDojo

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

DEFECTDOJO_URL
required
Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)
DEFECTDOJO_API_KEY
required
secret
API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.
DEFECTDOJO_READ_API_KEY
secret
Optional read-only API key (used for GET requests in dual-key mode)
DEFECTDOJO_WRITE_API_KEY
secret
Optional write API key (used for POST/PATCH in dual-key mode)
MCP_AUTH_TOKEN
secret
Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)
AUDIT_HMAC_KEY
secret
HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<YOUR_DEFECTDOJO_URL>",
        "DEFECTDOJO_API_KEY": "<YOUR_DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_READ_API_KEY": "<YOUR_DEFECTDOJO_READ_API_KEY>",
        "DEFECTDOJO_WRITE_API_KEY": "<YOUR_DEFECTDOJO_WRITE_API_KEY>",
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>",
        "AUDIT_HMAC_KEY": "<YOUR_AUDIT_HMAC_KEY>"
      }
    }
  }
}

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<YOUR_DEFECTDOJO_URL>",
        "DEFECTDOJO_API_KEY": "<YOUR_DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_READ_API_KEY": "<YOUR_DEFECTDOJO_READ_API_KEY>",
        "DEFECTDOJO_WRITE_API_KEY": "<YOUR_DEFECTDOJO_WRITE_API_KEY>",
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>",
        "AUDIT_HMAC_KEY": "<YOUR_AUDIT_HMAC_KEY>"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<YOUR_DEFECTDOJO_URL>",
        "DEFECTDOJO_API_KEY": "<YOUR_DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_READ_API_KEY": "<YOUR_DEFECTDOJO_READ_API_KEY>",
        "DEFECTDOJO_WRITE_API_KEY": "<YOUR_DEFECTDOJO_WRITE_API_KEY>",
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>",
        "AUDIT_HMAC_KEY": "<YOUR_AUDIT_HMAC_KEY>"
      }
    }
  }
}

VS Code

.vscode/mcp.json

{
  "servers": {
    "mcp-defectdojo": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<YOUR_DEFECTDOJO_URL>",
        "DEFECTDOJO_API_KEY": "<YOUR_DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_READ_API_KEY": "<YOUR_DEFECTDOJO_READ_API_KEY>",
        "DEFECTDOJO_WRITE_API_KEY": "<YOUR_DEFECTDOJO_WRITE_API_KEY>",
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>",
        "AUDIT_HMAC_KEY": "<YOUR_AUDIT_HMAC_KEY>"
      }
    }
  }
}

Claude Code

claude mcp add mcp-defectdojo --env DEFECTDOJO_URL=<YOUR_DEFECTDOJO_URL> --env DEFECTDOJO_API_KEY=<YOUR_DEFECTDOJO_API_KEY> --env DEFECTDOJO_READ_API_KEY=<YOUR_DEFECTDOJO_READ_API_KEY> --env DEFECTDOJO_WRITE_API_KEY=<YOUR_DEFECTDOJO_WRITE_API_KEY> --env MCP_AUTH_TOKEN=<YOUR_MCP_AUTH_TOKEN> --env AUDIT_HMAC_KEY=<YOUR_AUDIT_HMAC_KEY> -- uvx mcp-defectdojo