MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding
Connect Runs on your machine
claude mcp add mcp-defectdojo -e DEFECTDOJO_URL=<DEFECTDOJO_URL> -e DEFECTDOJO_API_KEY=<DEFECTDOJO_API_KEY> -e DEFECTDOJO_READ_API_KEY=<DEFECTDOJO_READ_API_KEY> -e DEFECTDOJO_WRITE_API_KEY=<DEFECTDOJO_WRITE_API_KEY> -e MCP_AUTH_TOKEN=<MCP_AUTH_TOKEN> -e AUDIT_HMAC_KEY=<AUDIT_HMAC_KEY> -- uvx mcp-defectdojo==3.3.2{
"mcpServers": {
"mcp-defectdojo": {
"command": "uvx",
"args": [
"mcp-defectdojo==3.3.2"
],
"env": {
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>",
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_READ_API_KEY": "<DEFECTDOJO_READ_API_KEY>",
"DEFECTDOJO_WRITE_API_KEY": "<DEFECTDOJO_WRITE_API_KEY>",
"MCP_AUTH_TOKEN": "<MCP_AUTH_TOKEN>",
"AUDIT_HMAC_KEY": "<AUDIT_HMAC_KEY>"
}
}
}
}{
"mcpServers": {
"mcp-defectdojo": {
"command": "uvx",
"args": [
"mcp-defectdojo==3.3.2"
],
"env": {
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>",
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_READ_API_KEY": "<DEFECTDOJO_READ_API_KEY>",
"DEFECTDOJO_WRITE_API_KEY": "<DEFECTDOJO_WRITE_API_KEY>",
"MCP_AUTH_TOKEN": "<MCP_AUTH_TOKEN>",
"AUDIT_HMAC_KEY": "<AUDIT_HMAC_KEY>"
}
}
}
}{
"servers": {
"mcp-defectdojo": {
"type": "stdio",
"command": "uvx",
"args": [
"mcp-defectdojo==3.3.2"
],
"env": {
"DEFECTDOJO_URL": "<DEFECTDOJO_URL>",
"DEFECTDOJO_API_KEY": "<DEFECTDOJO_API_KEY>",
"DEFECTDOJO_READ_API_KEY": "<DEFECTDOJO_READ_API_KEY>",
"DEFECTDOJO_WRITE_API_KEY": "<DEFECTDOJO_WRITE_API_KEY>",
"MCP_AUTH_TOKEN": "<MCP_AUTH_TOKEN>",
"AUDIT_HMAC_KEY": "<AUDIT_HMAC_KEY>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
DEFECTDOJO_URLRequired | Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true) |
DEFECTDOJO_API_KEYRequired, secret | API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode. |
DEFECTDOJO_READ_API_KEYOptional, secret | Optional read-only API key (used for GET requests in dual-key mode) |
DEFECTDOJO_WRITE_API_KEYOptional, secret | Optional write API key (used for POST/PATCH in dual-key mode) |
MCP_AUTH_TOKENOptional, secret | Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC) |
AUDIT_HMAC_KEYOptional, secret | HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))' |
Details
| Package | [email protected] (PYPI, stdio) |
| First published | 28 May 2026 |
| Last updated | 28 May 2026 |
| Registry name | io.github.inspicere/mcp-defectdojo |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.