# shyshlakov/pci-dss-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/shyshlakov/pci-dss-mcp  
**GitHub Stars:** 5  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/shyshlakov-pci-dss-mcp

## Description
PCI DSS v4.0.1 static-analysis MCP server for Go payment codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation - each finding mapped to the exact PCI requirement. AI-assisted triage via triagefindings. Keyless-signed multi-arch Docker image on ghcr.io.

## Tools
Capabilities this server exposes over MCP:

- **triage_findings** — All scanners + AI classification + file:line context in one call
- **generate_compliance_report** — Raw requirement pass/fail report (orchestrator over all scanners)
- **scan_pan_data** — PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1)
- **check_encryption** — Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4)
- **check_tls_config** — Insecure TLS configs (4.2.1)
- **check_secrets_in_configs** — Credentials in config files (8.6.2)
- **check_error_handling** — Error responses leaking sensitive context (6.2.4)
- **check_auth_strength** — Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2)
- **audit_log_coverage** — Missing audit logs on payment flows (10.2.1)
- **check_data_retention** — Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1)
- **check_payment_page_scripts** — Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1)
- **check_dependencies** — Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See [docs/check_dependencies.md](docs/check_dependencies.md#privacy). Also covers `update_vulnerability_db`.
- **generate_sbom** — CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2)
- **explain_requirement** — Look up a PCI DSS v4.0.1 requirement by ID

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/shyshlakov/pci-dss-mcp), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
go install github.com/shyshlakov/pci-dss-mcp@latest
```

2. Install:

```sh
docker pull ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2
```

## Documentation

## What shyshlakov/pci-dss-mcp MCP server does

shyshlakov/pci-dss-mcp MCP server performs static analysis against Go payment service codebases and associates detected issues with PCI DSS v4.0.1 requirement IDs. Its scope includes payment-specific patterns such as PAN or sensitive authentication data exposure, weak cryptography, insecure transport, credentials in configuration, authentication weaknesses, missing payment-flow audit logs, retention problems, and unsafe payment-page scripts.

The project is intended to complement—not replace—general-purpose security analysis. The README specifically distinguishes it from broad SAST tools such as Semgrep, CodeQL, and gosec, as well as from LLM-based code review. Its analysis is Go-specific, and its output should be treated as input to a compliance process rather than as a QSA determination.

## How it works

The stdio server exposes individual scanners plus orchestration tools through MCP. Each finding carries a requirement identifier mapped to a PCI DSS v4.0.1 line item. The combined triage operation runs the scanners, adds AI classification, and reports file-and-line context. A separate compliance-report operation aggregates scanner results into requirement-level pass/fail data.

Dependency analysis checks Go dependencies through OSV and is described as using govulncheck-style privacy: module names are not sent to OSV.dev. SBOM generation reads go.mod and go.sum and produces CycloneDX 1.6 output. The repository also documents HTTP input-flow analysis for several Go web frameworks and logging libraries.

## Setup and configuration

Install the binary with Go 1.25 or newer using `go install github.com/shyshlakov/pci-dss-mcp@latest`, or run the published Docker image from ghcr.io. The Docker configuration mounts the source tree read-only and mirrors the host path inside the container, allowing prompts to use the normal project path without translation.

Configure the stdio command in an MCP client. The README gives examples for Claude Desktop, Cursor, and Claude Code, including a Docker-based configuration. The project is also published in the MCP Registry. Documentation covers client setup, source installation, CI usage, scoping, exclusions, severity, and suppression of findings.

## Tools and capabilities

shyshlakov/pci-dss-mcp MCP server provides these capabilities:

- `triage_findings`: combines scanners with AI classification and file-line context.
- `generate_compliance_report`: produces raw requirement pass/fail results.
- `scan_pan_data`: checks PAN and SAD storage or logging.
- `check_encryption` and `check_tls_config`: inspect cryptography and TLS issues.
- `check_secrets_in_configs`, `check_error_handling`, and `check_auth_strength`: cover configuration credentials, sensitive error output, and authentication controls.
- `audit_log_coverage` and `check_data_retention`: inspect payment-flow logging and data lifecycle patterns.
- `check_payment_page_scripts`: checks CSP, SRI, and nonce-related controls.
- `check_dependencies`: checks vulnerable Go dependencies and can update its vulnerability database.
- `generate_sbom`: creates a CycloneDX 1.6 SBOM from Go module files.
- `explain_requirement`: looks up a PCI DSS v4.0.1 requirement by ID.

## Limitations and notes

The tool is not Go-agnostic, does not replace broad SAST or code review, and cannot replace a Qualified Security Assessor. The project is in active development and remains pre-v1.0, so supported rules and behavior may change between releases.

_Full upstream README: https://allmcps.com/mcp/shyshlakov-pci-dss-mcp/readme_