DefectDojo

Overview

DefectDojo is an MCP server that brings application security testing and vulnerability management into your AI workflow. It exposes 24 tools for interacting with DefectDojo, including role-based access control, HMAC audit chain support, and SIEM forwarding capabilities. AI assistants can now call DefectDojo directly as callable tools instead of requiring manual copy-paste between applications.

The server runs locally as a Python package installed via uvx mcp-defectdojo and communicates with your DefectDojo instance over stdio. You'll need to provide DEFECTDOJO_URL and DEFECTDOJO_API_KEY via environment variables for authentication. The latest release is v3.3.2, published under the MIT license with source code available at inspicere/mcp-defectdojo on GitHub.

DefectDojo is listed in the Development category on mcp.site and works with all major MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed. If you maintain this server, claim your listing to earn the Verified badge and keep information current.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<defectdojo-url>",
        "DEFECTDOJO_API_KEY": "<defectdojo-api-key>"
      }
    }
  }
}

Requires DEFECTDOJO_URL, DEFECTDOJO_API_KEY