Pci Dss MCP

What shyshlakov/pci-dss-mcp MCP server does

shyshlakov/pci-dss-mcp MCP server performs static analysis against Go payment service codebases and associates detected issues with PCI DSS v4.0.1 requirement IDs. Its scope includes payment-specific patterns such as PAN or sensitive authentication data exposure, weak cryptography, insecure transport, credentials in configuration, authentication weaknesses, missing payment-flow audit logs, retention problems, and unsafe payment-page scripts.

The project is intended to complement—not replace—general-purpose security analysis. The README specifically distinguishes it from broad SAST tools such as Semgrep, CodeQL, and gosec, as well as from LLM-based code review. Its analysis is Go-specific, and its output should be treated as input to a compliance process rather than as a QSA determination.

How it works

The stdio server exposes individual scanners plus orchestration tools through MCP. Each finding carries a requirement identifier mapped to a PCI DSS v4.0.1 line item. The combined triage operation runs the scanners, adds AI classification, and reports file-and-line context. A separate compliance-report operation aggregates scanner results into requirement-level pass/fail data.

Dependency analysis checks Go dependencies through OSV and is described as using govulncheck-style privacy: module names are not sent to OSV.dev. SBOM generation reads go.mod and go.sum and produces CycloneDX 1.6 output. The repository also documents HTTP input-flow analysis for several Go web frameworks and logging libraries.

Setup and configuration

Install the binary with Go 1.25 or newer using go install github.com/shyshlakov/pci-dss-mcp@latest, or run the published Docker image from ghcr.io. The Docker configuration mounts the source tree read-only and mirrors the host path inside the container, allowing prompts to use the normal project path without translation.

Configure the stdio command in an MCP client. The README gives examples for Claude Desktop, Cursor, and Claude Code, including a Docker-based configuration. The project is also published in the MCP Registry. Documentation covers client setup, source installation, CI usage, scoping, exclusions, severity, and suppression of findings.

Tools and capabilities

shyshlakov/pci-dss-mcp MCP server provides these capabilities:

• triage_findings: combines scanners with AI classification and file-line context.
• generate_compliance_report: produces raw requirement pass/fail results.
• scan_pan_data: checks PAN and SAD storage or logging.
• check_encryption and check_tls_config: inspect cryptography and TLS issues.
• check_secrets_in_configs, check_error_handling, and check_auth_strength: cover configuration credentials, sensitive error output, and authentication controls.
• audit_log_coverage and check_data_retention: inspect payment-flow logging and data lifecycle patterns.
• check_payment_page_scripts: checks CSP, SRI, and nonce-related controls.
• check_dependencies: checks vulnerable Go dependencies and can update its vulnerability database.
• generate_sbom: creates a CycloneDX 1.6 SBOM from Go module files.
• explain_requirement: looks up a PCI DSS v4.0.1 requirement by ID.

Limitations and notes

The tool is not Go-agnostic, does not replace broad SAST or code review, and cannot replace a Qualified Security Assessor. The project is in active development and remains pre-v1.0, so supported rules and behavior may change between releases.