Diffpilot

What diffpilot MCP server does

The diffpilot MCP server provides nine MCP tools for working with a local Git workspace. It can compare the current branch with a base branch, review the resulting changes, produce pull request text, and summarize repository changes. Other tools generate commit messages and changelogs, identify possible secrets, calculate diff statistics, and recommend tests.

The project is intended for review before a pull request is created, as well as for reviewers who have checked out a feature branch locally. Its Git operations use the workspace folder, so the repository must be available in the environment where the server runs.

How it works

DiffPilot examines local branch and change information rather than sending the work to a hosted review service. Base branch discovery can select main, master, or develop; the default can also be configured. Review prompts may include a requested focus, such as security or error handling.

The tools return generated review or development content to the MCP client. Secret scanning checks changes for items such as API keys, passwords, tokens, JWTs, private keys, and connection strings. Tool output is designed to redact detected secret patterns. The implementation also validates inputs, protects against command injection and path traversal, limits requests to 120 per minute, and records security events to stderr.

Setup and configuration

Installation is available through the VS Code Marketplace, the global .NET tool, or a manual clone and build. The documented commands are:

• VS Code: ext install BurakKalafat.diffpilot
• .NET tool: dotnet tool install -g DiffPilot
• Manual setup: clone the repository and run a .NET build

The documented requirements are the .NET 9 SDK, VS Code 1.101 or newer, and Git. VS Code users can invoke the tools through GitHub Copilot with workspace tool prompts.

Optional settings include diffpilot.defaultBaseBranch, diffpilot.prTitleStyle, and diffpilot.commitMessageStyle. The example configuration uses main and the conventional style for both pull request titles and commit messages.

Tools and capabilities

The nine tools are grouped into two practical sets:

• get_pr_diff compares the current work with a base branch.
• review_pr_changes analyzes changes and accepts a review focus.
• generate_pr_title creates a pull request title.
• generate_pr_description creates a pull request description with a checklist.
• generate_commit_message prepares a message for staged changes.
• scan_secrets checks changes for exposed credentials and related patterns.
• diff_stats reports additions, removals, and file-type breakdowns.
• suggest_tests recommends test cases using code patterns.
• generate_changelog creates changelog content from commits.

These capabilities make the diffpilot MCP server suitable for pre-push review, local reviewer workflows, pre-commit secret checks, and generating routine repository documentation.

Limitations and notes

That makes the server relevant to Azure DevOps, TFS, and air-gapped environments, but it also means the required Git workspace and local runtime must be available.

Review, generated text, and recommendations depend on the local repository state and the changes available to the tools. Secret scanning is a detection aid, and the documented redaction behavior applies to recognized patterns rather than guaranteeing that every sensitive value will be found.