该项目为DefectDojo提供了一个模式背景协议(MCP)服务器执行,这是一个受欢迎的开源脆弱性管理工具. 它允许AI代理和其他MCP客户端在程序上与DefectDojo API互动.

□ 特性

MCP 服务器显示用于管理 DefectDojo 关键实体的工具 :

• ** 调查结果:** 获取,搜索,创建,更新状态,并添加注释.
• ** 产品:** 列出可用的产品。 *** 动力:** 列表,检索细节,创建,更新和关闭约定.

□ 安装和运行

运行此服务器有几种方法:

使用 [[T0] (建议)

uvx在临时虚拟环境中执行 Python 应用程序,自动安装依赖性.

使用 pip

您可以使用 pip 将软件包安装到您的 Python 环境中。

通过 pip 安装后, 使用 :

□ 配置

服务器需要以下环境变量才能连接到您的 DefectDojo 实例 :

• [[T4] (必须): 您的 DefectDojo API 认证标志 。
• [[T5] (** 需要**): 您的 DefectDojo 实例的基础 URL (例如 [[T6] ) .

DefectDojo MCP Server

This project provides a Model Context Protocol (MCP) server implementation for DefectDojo, a popular open-source vulnerability management tool. It allows AI agents and other MCP clients to interact with the DefectDojo API programmatically.

Features

This MCP server exposes tools for managing key DefectDojo entities:

• Findings: Fetch, search, create, update status, and add notes.
• Products: List available products.
• Engagements: List, retrieve details, create, update, and close engagements.

Installation & Running

There are a couple of ways to run this server:

Using uvx (Recommended)

uvx executes Python applications in temporary virtual environments, installing dependencies automatically.

uvx defectdojo-mcp

Using pip

You can install the package into your Python environment using pip.

# Install directly from the cloned source code directory
pip install .

# Or, if the package is published on PyPI
pip install defectdojo-mcp

Once installed via pip, run the server using:

defectdojo-mcp

Configuration

The server requires the following environment variables to connect to your DefectDojo instance:

• DEFECTDOJO_API_TOKEN (required): Your DefectDojo API token for authentication.
• DEFECTDOJO_API_BASE (required): The base URL of your DefectDojo instance (e.g., https://your-defectdojo-instance.com).

You can configure these in your MCP client’s settings file. Here’s an example using the uvx command:

{
  "mcpServers": {
    "defectdojo": {
      "command": "uvx",
      "args": ["defectdojo-mcp"],
      "env": {
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE",
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com"
      }
    }
  }
}

If you installed the package using pip, the configuration would look like this:

{
  "mcpServers": {
    "defectdojo": {
      "command": "defectdojo-mcp",
      "args": [],
      "env": {
        "DEFECTDOJO_API_TOKEN": "YOUR_API_TOKEN_HERE",
        "DEFECTDOJO_API_BASE": "https://your-defectdojo-instance.com"
      }
    }
  }
}

Available Tools

The following tools are available via the MCP interface:

• get_findings: Retrieve findings with filtering (product_name, status, severity) and pagination (limit, offset).
• search_findings: Search findings using a text query, with filtering and pagination.
• update_finding_status: Change the status of a specific finding (e.g., Active, Verified, False Positive).
• add_finding_note: Add a textual note to a finding.
• create_finding: Create a new finding associated with a test.