MCP Server MCP

DefectDojo

By github 👁 1 views ▲ 0 votes

MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding

Homepage Verified source GitHub

Install

uvx mcp-defectdojo

Configuration Example

{
  "remotes": [],
  "packages": [
    {
      "registryType": "pypi",
      "registryBaseUrl": "https://pypi.org",
      "identifier": "mcp-defectdojo",
      "version": "3.3.2",
      "runtimeHint": "uvx",
      "transport": {
        "type": "stdio"
      },
      "environmentVariables": [
        {
          "description": "Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)",
          "isRequired": true,
          "name": "DEFECTDOJO_URL"
        },
        {
          "description": "API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode.",
          "isRequired": true,
          "isSecret": true,
          "name": "DEFECTDOJO_API_KEY"
        },
        {
          "description": "Optional read-only API key (used for GET requests in dual-key mode)",
          "isSecret": true,
          "name": "DEFECTDOJO_READ_API_KEY"
        },
        {
          "description": "Optional write API key (used for POST/PATCH in dual-key mode)",
          "isSecret": true,
          "name": "DEFECTDOJO_WRITE_API_KEY"
        },
        {
          "description": "Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC)",
          "isSecret": true,
          "name": "MCP_AUTH_TOKEN"
        },
        {
          "description": "HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'",
          "isSecret": true,
          "name": "AUDIT_HMAC_KEY"
        }
      ]
    }
  ]
}

mcp model-context-protocol pypi