# shyshlakov/pci-dss-mcp [Health: Active] **Category:** 🔒 Security **Repository:** https://github.com/shyshlakov/pci-dss-mcp **GitHub Stars:** 3 **Views:** 1 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/shyshlakov-pci-dss-mcp ## Description PCI DSS v4.0.1 static-analysis MCP server for Go payment codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation - each finding mapped to the exact PCI requirement. AI-assisted triage via triagefindings. Keyless-signed multi-arch Docker image on ghcr.io. ## Tools Capabilities this server exposes over MCP: - **triage_findings** — All scanners + AI classification + file:line context in one call - **generate_compliance_report** — Raw requirement pass/fail report (orchestrator over all scanners) - **scan_pan_data** — PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1) - **check_encryption** — Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4) - **check_tls_config** — Insecure TLS configs (4.2.1) - **check_secrets_in_configs** — Credentials in config files (8.6.2) - **check_error_handling** — Error responses leaking sensitive context (6.2.4) - **check_auth_strength** — Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2) - **audit_log_coverage** — Missing audit logs on payment flows (10.2.1) - **check_data_retention** — Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1) - **check_payment_page_scripts** — Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1) - **check_dependencies** — Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See [docs/check_dependencies.md](docs/check_dependencies.md#privacy). Also covers `update_vulnerability_db`. - **generate_sbom** — CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2) - **explain_requirement** — Look up a PCI DSS v4.0.1 requirement by ID ## Claude Desktop Quick Installation Install path detected from listing signals. Uses `docker` (confidence: high): ```json "mcpServers": { "pci-dss-mcp": { "command": "docker", "args": ["run","ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"] } } ``` ## Documentation & README # pci-dss-mcp > Static analysis MCP server for Go payment service codebases. Every detected PCI DSS v4.0.1 violation in a Go payment service codebase is mapped to the specific requirement number before the code ships. [![Go Report Card](https://goreportcard.com/badge/github.com/shyshlakov/pci-dss-mcp?v=2)](https://goreportcard.com/report/github.com/shyshlakov/pci-dss-mcp) [![License: MIT](https://img.shields.io/github/license/shyshlakov/pci-dss-mcp)](LICENSE) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/shyshlakov/pci-dss-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/shyshlakov/pci-dss-mcp) [![MCP Registry](https://img.shields.io/badge/MCP%20Registry-io.github.shyshlakov%2Fpci--dss--mcp-blue)](https://registry.modelcontextprotocol.io/v0/servers?search=pci-dss-mcp) [![pci-dss-mcp MCP server](https://glama.ai/mcp/servers/shyshlakov/pci-dss-mcp/badges/score.svg)](https://glama.ai/mcp/servers/shyshlakov/pci-dss-mcp) --- ## What it does pci-dss-mcp is a stdio MCP server that runs 12 scanners, an orchestrator, and an AI triage engine over a Go payment service codebase. Each finding carries a `requirement_id` mapped to a specific PCI DSS v4.0.1 line item; see [docs/requirement-mapping.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/requirement-mapping.md) for the canonical rule-to-requirement table and [testdata/vulnerable-payment-service/EXPECTED-FINDINGS.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/testdata/vulnerable-payment-service/EXPECTED-FINDINGS.md) for live golden output. ### What pci-dss-mcp catches today - **HTTP framework input flow into log / error / panic sinks.** Tier 1 frameworks (gin, chi, gorilla/mux, net/http (Go 1.22+), echo v4, fiber v2) and Tier 1 loggers (log/slog, logrus, zap, zerolog, logr, klog, hclog) ship in v0.7. Tier 2 (kratos, apex/log, charmbracelet/log) lands in v0.8. Tier 3 (fasthttp, beego, iris, httprouter, project-internal) is user-configurable via Phase 25 YAML once shipped. See [docs/http_input_taint.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/http_input_taint.md). ### What pci-dss-mcp is NOT - **Not a replacement for broad SAST.** Use Semgrep, CodeQL, or gosec for OWASP Top-10 and language-agnostic vulnerabilities. - **Not a replacement for LLM-based code review.** pci-dss-mcp maps payment-specific issues to PCI DSS requirement IDs; LLM agents catch broad bugs via reasoning. The two layers compose. - **Not Go-agnostic.** Go-specific AST patterns and taint flow tracing are what make the precision possible. - **Not a QSA replacement.** Static analysis covers ~6% of PCI DSS v4.0.1 requirements. A Qualified Security Assessor must sign off on the rest. ## Install ### Go install (primary) Requires **Go 1.25+**: ```bash go install github.com/shyshlakov/pci-dss-mcp@latest ``` The binary lands at `$(go env GOPATH)/bin/pci-dss-mcp`. See [docs/install-from-source.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/install-from-source.md) for PATH resolution, the macOS `codesign` provenance fix, cosign verification, and the MCP client JSON config. ### Docker (alternative) ```bash docker pull ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2 ``` Useful for CI pipelines, QSA auditors who do not develop Go locally, or any environment without a host Go toolchain. ### MCP Registry Listed as `io.github.shyshlakov/pci-dss-mcp` at [registry.modelcontextprotocol.io](https://registry.modelcontextprotocol.io/v0/servers?search=pci-dss-mcp). Auto-published on every tag. ## Usage Add to your MCP client config (Claude Desktop `claude_desktop_config.json`, Cursor `.cursor/mcp.json`, or `claude mcp add` for Claude Code): ```json { "mcpServers": { "pci-dss-mcp": { "command": "docker", "args": ["run", "-i", "--rm", "--mount", "type=bind,src=/Users/you/go/src,dst=/Users/you/go/src,readonly", "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"] } } } ``` `src=` and `dst=` mirror the same absolute path so the container sees your code at the same path your host uses; prompts pass the normal host path with no translation. For the `go install` variant and per-client examples, see [docs/usage.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/usage.md). Two prompts to paste into your MCP client: 1. `Run pci-dss-mcp triage on /Users/you/payments-service. Use min_severity=MEDIUM and group findings by PCI DSS requirement.` 2. `Generate a PCI DSS compliance report for /Users/you/payments-service in JSON format. Show requirement-level pass/fail status and severity counts.` ## Tools | Tool | Purpose | Docs | |------|---------|------| | `triage_findings` | All scanners + AI classification + file:line context in one call | [docs/triage_findings.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/triage_findings.md) | | `generate_compliance_report` | Raw requirement pass/fail report (orchestrator over all scanners) | [docs/generate_compliance_report.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/generate_compliance_report.md) | | `scan_pan_data` | PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1) | [docs/scan_pan_data.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/scan_pan_data.md) | | `check_encryption` | Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4) | [docs/check_encryption.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_encryption.md) | | `check_tls_config` | Insecure TLS configs (4.2.1) | [docs/check_tls_config.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_tls_config.md) | | `check_secrets_in_configs` | Credentials in config files (8.6.2) | [docs/check_secrets_in_configs.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_secrets_in_configs.md) | | `check_error_handling` | Error responses leaking sensitive context (6.2.4) | [docs/check_error_handling.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_error_handling.md) | | `check_auth_strength` | Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2) | [docs/check_auth_strength.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_auth_strength.md) | | `audit_log_coverage` | Missing audit logs on payment flows (10.2.1) | [docs/audit_log_coverage.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/audit_log_coverage.md) | | `check_data_retention` | Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1) | [docs/check_data_retention.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_data_retention.md) | | `check_payment_page_scripts` | Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1) | [docs/check_payment_page_scripts.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_payment_page_scripts.md) | | `check_dependencies` | Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See [docs/check_dependencies.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_dependencies.md#privacy). Also covers `update_vulnerability_db`. | [docs/check_dependencies.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/check_dependencies.md) | | `generate_sbom` | CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2) | [docs/generate_sbom.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/generate_sbom.md) | | `explain_requirement` | Look up a PCI DSS v4.0.1 requirement by ID | [docs/explain_requirement.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/explain_requirement.md) | All tools declare typed `OutputSchema`. See [docs/tools.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/tools.md) for the catalog index and migration history. ## Documentation - [docs/usage.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/usage.md), client setup, prompt templates, suppressing findings - [docs/severity.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/severity.md), severity model and rule-to-severity mapping - [docs/taint.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/taint.md), taint analysis defaults and toggles - [docs/scoping.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/scoping.md), package exclusion and CDE scope - [docs/comparison.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/comparison.md), pci-dss-mcp vs Semgrep / CodeQL / gosec / Snyk Code - [docs/ci-cd.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/ci-cd.md), GitHub Actions and GitLab CI integration - [docs/pci-coverage.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/pci-coverage.md), PCI DSS v4.0.1 requirement coverage matrix - [docs/install-from-source.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/install-from-source.md), source build, cosign verification, reload - [docs/requirement-mapping.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/docs/requirement-mapping.md), canonical rule_id to requirement_id table - [CONTRIBUTING.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/CONTRIBUTING.md), development setup, fuzz targets - [ROADMAP.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/ROADMAP.md), planned features - [CHANGELOG.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/CHANGELOG.md), version history ## Status Active development, pre v1.0. See [ROADMAP.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/ROADMAP.md) and [CHANGELOG.md](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/CHANGELOG.md). ## License MIT, see [LICENSE](https://github.com/shyshlakov/pci-dss-mcp/blob/HEAD/LICENSE). --- *pci-dss-mcp is a static analysis tool. It cannot replace a Qualified Security Assessor. Use its output as input to your compliance process, not as the compliance itself.*