DefectDojo

io.github.inspicere/mcp-defectdojo

MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding

View repository →

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "<your DEFECTDOJO_URL>",
        "DEFECTDOJO_API_KEY": "<your DEFECTDOJO_API_KEY>",
        "DEFECTDOJO_READ_API_KEY": "<your DEFECTDOJO_READ_API_KEY>",
        "DEFECTDOJO_WRITE_API_KEY": "<your DEFECTDOJO_WRITE_API_KEY>",
        "MCP_AUTH_TOKEN": "<your MCP_AUTH_TOKEN>",
        "AUDIT_HMAC_KEY": "<your AUDIT_HMAC_KEY>"
      }
    }
  }
}
Environment variables
  • DEFECTDOJO_URLrequiredBase URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)
  • DEFECTDOJO_API_KEYrequiredsecretAPI key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.
  • DEFECTDOJO_READ_API_KEYsecretOptional read-only API key (used for GET requests in dual-key mode)
  • DEFECTDOJO_WRITE_API_KEYsecretOptional write API key (used for POST/PATCH in dual-key mode)
  • MCP_AUTH_TOKENsecretBearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)
  • AUDIT_HMAC_KEYsecretHMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
3.3.2
Registry
active
Published
5/28/2026

More Developer Tools servers

Browse all Developer Tools →

Rootr

inspirio-co

Connect your team's living knowledge base — docs, data, issues, CRM — to Claude and ChatGPT.

Developer ToolsAdded 3 months ago

INSSIST

inssist

Drive your own logged-in Instagram session via the INSSIST extension: read, publish, DMs, analytics.

Developer ToolsAdded 1 month ago

io.github.instagitai/instagit

InstalabsAI

MCP server for Instagit — AI-powered Git repository analysis for coding agents

Developer ToolsAdded 9 months ago

io.github.InstaNode-dev/mcp

InstaNode-dev

Provision Postgres databases + webhooks from AI coding agents in one HTTP call.

Developer ToolsAdded 6 months ago

Instant Expert

Instant-Expert

Invite specific execs and experts to a paid call or written answer. Pay only if they book or answer.

Developer ToolsAdded 1 month ago

AppWrangler

IntarsO

Per-app CPU, efficiency-core and memory control for Apple Silicon Macs, with suggestions and undo.

Developer ToolsAdded 4 weeks ago

Add the badge to your site

Show visitors that DefectDojo is listed here — it’s also the link we check for a free listing.

DefectDojo — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-inspicere-mcp-defectdojo?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="DefectDojo — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![DefectDojo — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-inspicere-mcp-defectdojo?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.