Server data from the Official MCP Registry
MR/PR risk audit MCP server: semantic diff + rule engine, strict read-only. Run as image or pip.
About
MR/PR risk audit MCP server: semantic diff + rule engine, strict read-only. Run as image or pip.
Security Report
DiffSense is a PR/MR change-risk auditing tool with CLI, CI adapters, and a read-only MCP server; the reviewed manifests and README show no malicious patterns or hardcoded secrets. Network access to GitHub/GitLab APIs and git-diff file reads match its stated purpose, and the MCP server is described as read-only. The truncated minified website bundle is a React build artifact with no security concerns visible, though the actual MCP server source (mcp_server.py) was not provided for direct review, so the score reflects manifest-level analysis only. Supply chain analysis found 16 known vulnerabilities in dependencies (4 critical, 3 high severity). Package verification found 1 issue.
10 files analyzed · 21 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-goldensupremesaltedfish-diffsense": {
"args": [
"-y",
"website-app"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
DiffSense
DiffSense is a Change Risk Gate for the PR stage: it evaluates whether the current diff introduces regression risks without performing full codebase scans or style checks. Designed for minimal alerts, high precision, low latency, and interpretable results.
Quick Start
| Scenario | Action |
|---|---|
| GitHub Pull Request | Copy the workflow from diffsense/docs/quickstart.md (Method 1) to .github/workflows/diffsense.yml in your target repository. Uses the default GITHUB_TOKEN with no additional configuration required. After committing and creating/updating a PR, the workflow will automatically execute the audit and post results under the PR. |
| Local Audit | Run pip install -e diffsense in the repository root, or pip install "git+https://github.com/GoldenSupremeSaltedFish/DiffSense.git@main#subdirectory=diffsense", then execute diffsense replay <path-to-diff>. |
| Agent / LLM Integration | Install the MCP server with pip install "diffsense[mcp]" and run diffsense-mcp, or consume the JSON contract / SARIF directly. See Agent Integration Guide. |
Complete steps are available at diffsense/docs/quickstart.md.
Optional: Add .diffsense.yaml to your repository root to use the officially recommended configuration, suitable for most teams.
Features
- CI / Local: Performs semantic risk auditing on MR/PR diffs, outputting
review_leveland recommended actions. Analyzes only changed content without slowing down pipelines. Low-quality rules are automatically downgraded. Does not automatically modify CI status; decisions to block are made manually or by downstream processes. - Agent / LLM Integration: Deterministic, machine-readable surfaces for agents and CI gates — versioned JSON contract (
schema_version), SARIF 2.1.0 output, and a read-only MCP server (audit_diff/audit_replay/list_rules/explain_rule). See the Agent Integration Guide and CLI Contract. - VSCode Extension: Maintained in the vscode-extension directory of this repository (dual-artifact layout). Install from the Marketplace or download the VSIX from Releases.
Quick Start (Detailed)
GitHub Actions
Copy the complete YAML from diffsense/docs/quickstart.md (Method 1) to your repository's .github/workflows/diffsense.yml to enable PR auditing.
GitLab CI
- In your project, go to Settings → CI/CD → Variables and add the variable
DIFFSENSE_TOKEN(Personal Access Token withapipermissions; recommended to check Mask variable). - Add the corresponding job to
.gitlab-ci.yml. See the example at diffsense/gitlab-ci-example.yml.
VSCode Extension
Maintained in the vscode-extension directory of this repository. Install from the Marketplace or download the VSIX from Releases.
Project Structure (This Branch)
DiffSense/
├── diffsense/ # CLI, rule engine, GitHub/GitLab adapters, MCP server; see docs/quickstart.md for quick start
├── vscode-extension/ # VS Code extension (dual-artifact line)
├── AGENTS.md # repository guide for AI coding agents
└── technical_documentation/
Development
git clone https://github.com/GoldenSupremeSaltedFish/DiffSense.git
cd DiffSense/diffsense
pip install -e ".[dev]"
pytest tests/ -v
See diffsense/CONTRIBUTING.md for details.
License & Links
- License: Apache-2.0
- Issues: Report a bug
- Marketplace: DiffSense
English | 中文版（存档）
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Worldmonitor
Freeby Koala73 · Developer Tools
Live markets, conflicts, country risk, chokepoints, energy, and China decision signals. 93 tools.
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.