Help us shape the future of Go! Take the 2026 Go Developer Survey

pci-dss-mcp

command module
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 29, 2026 License: MIT Imports: 18 Imported by: 0

README

pci-dss-mcp

Static analysis MCP server for Go payment service codebases. Every detected PCI DSS v4.0.1 violation in a Go payment service codebase is mapped to the specific requirement number before the code ships.

Go Report Card OpenSSF Scorecard MCP Registry pci-dss-mcp MCP server

What it does

pci-dss-mcp is a stdio MCP server that runs 12 scanners, an orchestrator, and an AI triage engine over a Go payment service codebase. Each finding carries a requirement_id mapped to a specific PCI DSS v4.0.1 line item; see docs/requirement-mapping.md for the canonical rule-to-requirement table and testdata/vulnerable-payment-service/EXPECTED-FINDINGS.md for live golden output.

What pci-dss-mcp catches today
  • HTTP framework input flow into log / error / panic sinks. Tier 1 frameworks (gin, chi, gorilla/mux, net/http (Go 1.22+), echo v4, fiber v2) and Tier 1 loggers (log/slog, logrus, zap, zerolog, logr, klog, hclog) ship in v0.7. Tier 2 (kratos, apex/log, charmbracelet/log) lands in v0.8. Tier 3 (fasthttp, beego, iris, httprouter, project-internal) is user-configurable via Phase 25 YAML once shipped. See docs/http_input_taint.md.
What pci-dss-mcp is NOT
  • Not a replacement for broad SAST. Use Semgrep, CodeQL, or gosec for OWASP Top-10 and language-agnostic vulnerabilities.
  • Not a replacement for LLM-based code review. pci-dss-mcp maps payment-specific issues to PCI DSS requirement IDs; LLM agents catch broad bugs via reasoning. The two layers compose.
  • Not Go-agnostic. Go-specific AST patterns and taint flow tracing are what make the precision possible.
  • Not a QSA replacement. Static analysis covers ~6% of PCI DSS v4.0.1 requirements. A Qualified Security Assessor must sign off on the rest.

Install

Go install (primary)

Requires Go 1.25+:

go install github.com/shyshlakov/pci-dss-mcp@latest

The binary lands at $(go env GOPATH)/bin/pci-dss-mcp. See docs/install-from-source.md for PATH resolution, the macOS codesign provenance fix, cosign verification, and the MCP client JSON config.

Docker (alternative)
docker pull ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2

Useful for CI pipelines, QSA auditors who do not develop Go locally, or any environment without a host Go toolchain.

MCP Registry

Listed as io.github.shyshlakov/pci-dss-mcp at registry.modelcontextprotocol.io. Auto-published on every tag.

Usage

Add to your MCP client config (Claude Desktop claude_desktop_config.json, Cursor .cursor/mcp.json, or claude mcp add for Claude Code):

{
  "mcpServers": {
    "pci-dss-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm",
        "--mount", "type=bind,src=/Users/you/go/src,dst=/Users/you/go/src,readonly",
        "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"]
    }
  }
}

src= and dst= mirror the same absolute path so the container sees your code at the same path your host uses; prompts pass the normal host path with no translation. For the go install variant and per-client examples, see docs/usage.md.

Two prompts to paste into your MCP client:

  1. Run pci-dss-mcp triage on /Users/you/payments-service. Use min_severity=MEDIUM and group findings by PCI DSS requirement.
  2. Generate a PCI DSS compliance report for /Users/you/payments-service in JSON format. Show requirement-level pass/fail status and severity counts.

Tools

Tool Purpose Docs
triage_findings All scanners + AI classification + file:line context in one call docs/triage_findings.md
generate_compliance_report Raw requirement pass/fail report (orchestrator over all scanners) docs/generate_compliance_report.md
scan_pan_data PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1) docs/scan_pan_data.md
check_encryption Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4) docs/check_encryption.md
check_tls_config Insecure TLS configs (4.2.1) docs/check_tls_config.md
check_secrets_in_configs Credentials in config files (8.6.2) docs/check_secrets_in_configs.md
check_error_handling Error responses leaking sensitive context (6.2.4) docs/check_error_handling.md
check_auth_strength Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2) docs/check_auth_strength.md
audit_log_coverage Missing audit logs on payment flows (10.2.1) docs/audit_log_coverage.md
check_data_retention Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1) docs/check_data_retention.md
check_payment_page_scripts Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1) docs/check_payment_page_scripts.md
check_dependencies Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See docs/check_dependencies.md. Also covers update_vulnerability_db. docs/check_dependencies.md
generate_sbom CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2) docs/generate_sbom.md
explain_requirement Look up a PCI DSS v4.0.1 requirement by ID docs/explain_requirement.md

All tools declare typed OutputSchema. See docs/tools.md for the catalog index and migration history.

Documentation

Status

Active development, pre v1.0. See ROADMAP.md and CHANGELOG.md.

License

MIT, see LICENSE.

pci-dss-mcp is a static analysis tool. It cannot replace a Qualified Security Assessor. Use its output as input to your compliance process, not as the compliance itself.

Documentation

The Go Gopher

There is no documentation for this package.

Source Files

View all Source files

Directories

Path Synopsis
internal
analysis
Package analysis provides shared data classification utilities for PCI DSS scanners.
 Package analysis provides shared data classification utilities for PCI DSS scanners.
detector
Package detector provides framework-aware HTTP handler detection for use across PCI DSS scanners.
 Package detector provides framework-aware HTTP handler detection for use across PCI DSS scanners.
keywords
Package keywords provides shared keyword matching for payment-related function names and URL path segments.
 Package keywords provides shared keyword matching for payment-related function names and URL path segments.
taint
Package taint is the type-aware data-flow analysis engine for the PCI-MCP compliance scanner.
 Package taint is the type-aware data-flow analysis engine for the PCI-MCP compliance scanner.
taint_ssa
Package taint_ssa is a research-only PoC that ports two PCI DSS detection rules (PAN-LOGGER, CRYPTO-HARDCODED-KEY) from the existing AST taint engine in internal/taint to an SSA-based engine built on golang.org/x/tools/go/ssa.
 Package taint_ssa is a research-only PoC that ports two PCI DSS detection rules (PAN-LOGGER, CRYPTO-HARDCODED-KEY) from the existing AST taint engine in internal/taint to an SSA-based engine built on golang.org/x/tools/go/ssa.
tools/sbomdump command
Package scanner defines shared types for all PCI DSS compliance scanners.
 Package scanner defines shared types for all PCI DSS compliance scanners.
auditscanner
Package auditscanner detects payment HTTP handlers missing structured audit logging as required by PCI DSS 10.2.1.
 Package auditscanner detects payment HTTP handlers missing structured audit logging as required by PCI DSS 10.2.1.
authscanner
Package authscanner implements the authentication strength scanner that detects weak authentication patterns in Go source files: hardcoded passwords, weak password policies, and missing MFA middleware on payment routes.
 Package authscanner implements the authentication strength scanner that detects weak authentication patterns in Go source files: hardcoded passwords, weak password policies, and missing MFA middleware on payment routes.
cryptoscanner
Package cryptoscanner implements the encryption scanner that detects weak hash algorithms, hardcoded encryption keys/IVs, and plain HTTP URLs in Go source files.
 Package cryptoscanner implements the encryption scanner that detects weak hash algorithms, hardcoded encryption keys/IVs, and plain HTTP URLs in Go source files.
depscanner
Package depscanner implements PCI DSS 6.3.3 dependency vulnerability scanning.
 Package depscanner implements PCI DSS 6.3.3 dependency vulnerability scanning.
errorscanner
Package errorscanner implements the error handling scanner that detects payment handlers leaking internal error details to HTTP responses.
 Package errorscanner implements the error handling scanner that detects payment handlers leaking internal error details to HTTP responses.
httpinputscanner
Package httpinputscanner detects HTTP framework input flowing into log, error, and panic sinks without a sanitizer barrier.
 Package httpinputscanner detects HTTP framework input flowing into log, error, and panic sinks without a sanitizer barrier.
hybrid
hybridcache
Package hybridcache provides the session cache and cursor encoding used by the three MCP tools (generate_compliance_report, triage_findings, scan_pan_data) to share paginated results.
 Package hybridcache provides the session cache and cursor encoding used by the three MCP tools (generate_compliance_report, triage_findings, scan_pan_data) to share paginated results.
internal/sensitivedata
panscanner
Package panscanner implements PAN/cardholder data detection primitives.
 Package panscanner implements PAN/cardholder data detection primitives.
reportscanner
retentionscanner
Package retentionscanner detects unsafe data retention patterns that violate PCI DSS 3.2.1 and 3.3.1: Redis/DB storage of sensitive authentication data without TTL, config files missing TTL on sensitive keys, and incorrect memory zeroing timing after authorization.
 Package retentionscanner detects unsafe data retention patterns that violate PCI DSS 3.2.1 and 3.3.1: Redis/DB storage of sensitive authentication data without TTL, config files missing TTL on sensitive keys, and incorrect memory zeroing timing after authorization.
sbomscanner
scriptscanner
Package scriptscanner detects CSP header violations in Go payment handlers and SRI/nonce violations in HTML templates as required by PCI DSS 6.4.3 and 11.6.1.
 Package scriptscanner detects CSP header violations in Go payment handlers and SRI/nonce violations in HTML templates as required by PCI DSS 6.4.3 and 11.6.1.
secretscanner
Package secretscanner implements a secrets scanner that detects hardcoded secrets in configuration files (.env,.yaml,.json,.toml).
 Package secretscanner implements a secrets scanner that detects hardcoded secrets in configuration files (.env,.yaml,.json,.toml).
sqlscanner
Package sqlscanner detects sensitive cardholder columns in SQL schema files and Go gorm/db/sql struct tags that persist PAN/SAD without application-level encryption.
 Package sqlscanner detects sensitive cardholder columns in SQL schema files and Go gorm/db/sql struct tags that persist PAN/SAD without application-level encryption.
suppression
Package suppression provides centralized suppression of scanner findings via inline pci-ignore comments and.pci-dss-mcp-ignore file rules.
 Package suppression provides centralized suppression of scanner findings via inline pci-ignore comments and.pci-dss-mcp-ignore file rules.
tlsscanner
Package tlsscanner implements the TLS configuration scanner that detects InsecureSkipVerify, weak MinVersion, missing MinVersion, and prohibited cipher suites in tls.Config composite literals and field assignments.
 Package tlsscanner implements the TLS configuration scanner that detects InsecureSkipVerify, weak MinVersion, missing MinVersion, and prohibited cipher suites in tls.Config composite literals and field assignments.
triagescanner

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.