Diffgate

What srbsa/diffgate MCP server does

The srbsa/diffgate MCP server provides an MCP interface to DiffGate's code-review engine. It focuses on changes rather than treating every existing issue in a file as new. The engine checks changed lines for security risks such as SQL injection, SSRF, XXE, permissive CORS, prototype pollution, and hardcoded secrets. It also supports structural checks for reinvented helpers and over-abstraction across eight languages.

Results are tiered so an agent can distinguish changes that can pass, changes that need a look, and higher-impact changes that need verification. Findings can include a verdict describing whether the change should pass, be reviewed, escalated, autofixed, or remain advisory.

How it works

Call diffgate_analyze for one file, including unsaved or generated content through the content parameter. For repository-wide review, diffgate_check_staged examines staged or working-tree changes and returns counts, per-file findings, an overall tier, and a verdict block.

The server compares code with the Git baseline, so unchanged lines are normally outside the review scope. When a code graph is available, public-surface findings can include caller counts, suggested reviewers, and test gaps. That information may adjust a finding's tier based on its likely blast radius.

diffgate_deep_review investigates one high-impact finding with repository tools such as search, file reading, reference lookup, and blame inspection. diffgate_explain provides a shorter explanation using one model call without a tool loop. diffgate_guidelines checks directory-scoped guidance files, including AGENTS.md, CLAUDE.md, and .cursorrules. Host-mode guideline results are advisory self-reviews rather than independent model gates.

Setup and configuration

Install the package globally with npm install -g diffgate-review, then start the MCP server with diffgate mcp. A Claude Code registration uses claude mcp add diffgate -- diffgate mcp; Cursor can register the same command with diffgate and the mcp argument. Claude Desktop can use the published diffgate.mcpb package.

For repository setup, run diffgate init. It detects the language and test command and writes .diffgate.json. The CLI can also scan a demonstration setup with diffgate init --demo.

Tools and capabilities

• diffgate_capabilities reports active core, code-graph, and LLM layers, available tools, and the autonomy budget.
• diffgate_feedback stores confirm or dismiss decisions in .diffgate/learnings.json; dismissals suppress matching rule-and-code findings in later reviews.
• Core checks run without LLM tokens. Model-assisted explanations, deep reviews, and configured guideline reviews use the model path described by their result mode.
• The same engine is also available through the CLI, editor extensions, pre-commit hooks, and CI, although those surfaces are outside the MCP tool interface.

Limitations and notes

The MCP tools are most useful when a Git baseline or repository context is available. diffgate_analyze can inspect content that has not been written to disk, but repository-wide checks depend on the repository's staged or working-tree state. Code-graph impact fields are conditional on a graph being available.

Guideline results in host mode must not independently block a change because the calling agent performs the evaluation. Deep review is limited to a selected high-impact finding, while explanation is intentionally narrower and does not perform repository tool loops. DiffGate's published benchmark reports zero false blocks on its versioned clean-change corpus; that result is a benchmark claim, not a guarantee for every repository or codebase.