How do I install DefectDojo?

Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.

Is DefectDojo official?

No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.

How is the trust score calculated?

This listing scores 45 (Fair). The formula is published on the methodology page.

MCPpedia

DefectDojo MCP Server | MCPpedia

DefectDojo MCP Server

Name: DefectDojo MCP Server
Author: inspicere

MCP server for DefectDojo: 24 tools with RBAC, HMAC audit chain, and SIEM forwarding

Tools Versions Alternatives

Registryinspicere

45Fair

Install

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "inspicere-mcp-defectdojo": {
      "command": "uvx",
      "args": [
        "mcp-defectdojo"
      ],
      "env": {
        "DEFECTDOJO_URL": "",
        "DEFECTDOJO_API_KEY": "YOUR_DEFECTDOJO_API_KEY",
        "DEFECTDOJO_READ_API_KEY": "YOUR_DEFECTDOJO_READ_API_KEY",
        "DEFECTDOJO_WRITE_API_KEY": "YOUR_DEFECTDOJO_WRITE_API_KEY",
        "MCP_AUTH_TOKEN": "YOUR_MCP_AUTH_TOKEN",
        "AUDIT_HMAC_KEY": "YOUR_AUDIT_HMAC_KEY"
      }
    }
  }
}

Install guide

Related servers

kordoc

83Excellent

Parse Korean documents (HWP, HWPX, PDF, XLSX, DOCX, PPTX) to Markdown; fill forms, diff, render.

Registrychrisryugj2.5K stars31.7K/wk

Firecrawl MCP Server

77Good

MCP server for Firecrawl — web search, scraping, and biomedical/arXiv paper search.

Environment

Name	Required	Notes
DEFECTDOJO_URL	Yes	Base URL of the DefectDojo instance (must use https:// unless ALLOW_INSECURE_HTTP=true)
DEFECTDOJO_API_KEY	Yes	API key for DefectDojo (generate at DefectDojo > API v2 > Your API Key). Use DEFECTDOJO_READ_API_KEY + DEFECTDOJO_WRITE_API_KEY for least-privilege dual-key mode. Secret.
DEFECTDOJO_READ_API_KEY	No	Optional read-only API key (used for GET requests in dual-key mode) Secret.
DEFECTDOJO_WRITE_API_KEY	No	Optional write API key (used for POST/PATCH in dual-key mode) Secret.
MCP_AUTH_TOKEN	No	Bearer token granting admin-role access (legacy single-token mode — prefer MCP_ROLE_<NAME>=<token>:<role> for RBAC) Secret.
AUDIT_HMAC_KEY	No	HMAC key for audit log integrity chain. Required for cross-restart log verification on network transports. Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))' Secret.

DefectDojo MCP Server

Install

Related servers

kordoc

Firecrawl MCP Server

Environment

Tools

About

FAQ

Reviews

pagespeed-insights-mcp

World Monitor

Hive Intelligence MCP

supply-chain-guard