1. Conduid
  2. Security
  3. io.github.bkalafat/diffpilot
MCP server · Security

io.github.bkalafat/diffpilot

by · github.com/bkalafat/DiffPilot

MCP server for PR code review, commit messages, changelogs, and secret detection.

Unclaimed last commit 9 months ago security
InstallView source
34Low

Scored 6 months ago · breakdown

About io.github.bkalafat/diffpilot

io.github.bkalafat/diffpilot is an MCP server published by bkalafat in the Security category: mCP server for PR code review, commit messages, changelogs, and secret detection.

The repository has 5 stars and 2 forks, with the last commit 9 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/bkalafat/DiffPilot

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (4)

#generate_pr_description"Create PR description with checklist"

Parameters not published.

#generate_pr_title"Generate a conventional PR title"

Parameters not published.

#get_pr_diff"Show diff between my branch and main"

Parameters not published.

#review_pr_changes"Review my PR for security issues"

Parameters not published.

Ask AI

✦

Ask AI about io.github.bkalafat/diffpilot

Powered by Claude · Grounded in docs

I know everything about io.github.bkalafat/diffpilot. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ✓README presentThe repository ships documentation.

5 checks have not been run yet.

README

🔍 DiffPilot

Local AI Code Review Before You Push

.NET 9 VS Code MCP

💡 Why DiffPilot?

Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:

  1. Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
  2. Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
  3. Auto Branch Detection - No need to specify main - DiffPilot finds your base branch automatically

🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.

🚀 Quick Start

Install

# VS Code Marketplace
ext install BurakKalafat.diffpilot

# Or NuGet (.NET tool)
dotnet tool install -g DiffPilot

Use with GitHub Copilot

# Review my changes (auto-detects base branch)
@workspace #review_pr_changes

# Review with focus areas
@workspace #review_pr_changes focus on security and error handling

# Generate commit message
@workspace #generate_commit_message

# Scan for secrets before committing
@workspace #scan_secrets

🛠️ 9 MCP Tools

PR Review Tools

Tool Example Prompt
#get_pr_diff "Show diff between my branch and main"
#review_pr_changes "Review my PR for security issues"
#generate_pr_title "Generate a conventional PR title"
#generate_pr_description "Create PR description with checklist"

Developer Tools

Tool Example Prompt
#generate_commit_message "Generate commit message for staged changes"
#scan_secrets "Check for API keys in my changes"
#diff_stats "Show change statistics"
#suggest_tests "What tests should I write?"
#generate_changelog "Generate changelog from commits"

✨ Key Features

Feature Description
🔄 Auto Branch Detection Automatically finds main, master, or develop
🔐 Secret Scanning Detects API keys, passwords, tokens, JWT
📊 Diff Statistics Lines added/removed, file breakdown by type
🧪 Test Suggestions Pattern-based test case recommendations
📝 Conventional Commits Generate feat:, fix:, refactor: messages
🛡️ Enterprise Security Bank-grade input validation, rate limiting, output sanitization

🛡️ Security

DiffPilot implements enterprise-grade security features:

Security Feature Description
Input Validation All parameters validated against strict patterns
Injection Prevention Command injection, path traversal protection
Output Sanitization Auto-redacts secrets from tool outputs
Rate Limiting Prevents DoS attacks (120 req/min)
Secure Errors No internal details exposed to clients
Audit Logging Security events logged to stderr

Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.

See SECURITY.md for full documentation.

📋 Use Cases

1. Self-Review Before PR

# After finishing your work, before creating PR:
@workspace #review_pr_changes

# AI reviews your changes and provides feedback
# Fix issues locally, then push with confidence

2. Code Reviewer Workflow

# Checkout the feature branch locally
git checkout feature/user-auth

# Use DiffPilot to review
@workspace #review_pr_changes focus on security

# Get structured review with AI assistance

3. Pre-Commit Secret Check

@workspace #scan_secrets

# Catches API keys, passwords, tokens before they're committed

⚙️ Configuration

{
  "diffpilot.defaultBaseBranch": "main",
  "diffpilot.prTitleStyle": "conventional",
  "diffpilot.commitMessageStyle": "conventional"
}

📦 Installation Options

Method Command
VS Code ext install BurakKalafat.diffpilot
NuGet dotnet tool install -g DiffPilot
Manual git clone + dotnet build

Requirements: .NET 9 SDK, VS Code 1.101+, Git

📜 Version History

1.2.0 (2025-12-09)

  • Security Hardening - Bank-grade security features
    • Input validation (CWE-20)
    • Command injection prevention (CWE-78)
    • Path traversal protection (CWE-22)
    • Output sanitization - auto-redacts secrets (CWE-200)
    • Rate limiting (CWE-400)
    • Secure error handling
  • Added SECURITY.md documentation
  • 80 new security unit tests

1.1.5 (2025-12-08)

  • Updated README with use cases and #tool prompts
  • Highlighted auto branch detection

1.1.4 (2025-12-07)

  • Icon refinements

1.1.3 (2025-12-07)

  • New extension icon (lens with plus/minus)

1.1.2 (2025-12-07)

  • Optimized package size

1.1.1 (2025-12-07)

  • Updated extension icon

1.1.0 (2025-12-07)

  • Improved tool documentation

1.0.9 (2025-12-07)

  • Fixed: Server uses workspace folder for git operations

1.0.8 (2025-12-07)

  • Shortened tool descriptions for cleaner UI

1.0.7 (2025-12-07)

  • Fixed: Bundled server includes TargetFramework

1.0.6 (2025-12-07)

  • Fixed: MCP auto-registration for VS Code 1.101+

1.0.5 (2025-12-07)

  • Published to NuGet and MCP Registry

1.0.0 (2025-12-06)

  • Initial release with 9 MCP tools

📄 License

MIT License - Burak Kalafat

GitHub • VS Code Marketplace • NuGet

⭐ Star if useful!

README copy captured when this server was indexed; it may lag the repository. The original is authoritative.

Questions

About io.github.bkalafat/diffpilot

How do I install io.github.bkalafat/diffpilot?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is io.github.bkalafat/diffpilot safe to use with an AI agent?

Its trust score is 34 out of 100 (low). It passes 1 of the 1 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is io.github.bkalafat/diffpilot still maintained?

The last commit was 9 months ago. That's long enough that you should check whether the maintainer is responding to issues before depending on it.