PCI DSS MCP

by shyshlakov

345 downloads

Not rated

GitHub

About

PCI DSS v4.0.1 static-analysis MCP server for Go payment service codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation. Each finding maps to the exact PCI requirement. A

Details

Author: shyshlakov
Downloads: 345
Categories: Developer Tools, Security

- PAN/CVV storage, masking, and zeroing detection
- Weak encryption and hardcoded key checks
- TLS misconfiguration auditing (cipher, version)
- Secrets and credentials in configuration detection
- Missing or unstructured audit log identification
- Dependency vulnerability scanning via OSV.dev (offline)

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name PCI DSS MCP

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

From the repository

Install via Docker (mount your Go source read-only) or go install github.com/shyshlakov/pci-dss-mcp@v0.6.2. Add the corresponding command to your MCP client configuration (e.g., pci-dss-mcp or the docker run command).

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "pci dss mcp": {
            "pci-dss-mcp": {
                "command": "docker",
                "args": [
                    "run",
                    "-i",
                    "--rm",
                    "--mount",
                    "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
                    "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
                ]
            }
        }
    }
}

McpServers

{
    "pci-dss-mcp": {
        "command": "docker",
        "args": [
            "run",
            "-i",
            "--rm",
            "--mount",
            "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
            "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
        ]
    }
}

pci-dss-mcp

Static-analysis MCP server that detects PCI DSS v4.0.1 violations in Go payment service codebases. Every finding maps to a specific PCI DSS requirement number. Built for developers, QSAs, and CI gates.

What it detects

12 scanners over Go source + configs, each mapped to PCI DSS requirements: | Tool | Detects | PCI DSS | |------|---------|---------| | scan_pan_data | PAN/CVV storage, masking, zeroing | 3.3.1, 3.4.1, 3.5.1 | | check_encryption | weak hashes, hardcoded keys, plain HTTP | 6.2.4, 4.2.1 | | check_tls_config | InsecureSkipVerify, weak MinVersion, prohibited ciphers | 4.2.1 | | check_secrets_in_configs | API keys, passwords, connection strings in configs | 8.6.2 | | check_error_handling | payment-handler error disclosure | 6.2.4 | | check_auth_strength | hardcoded passwords, weak password policy, missing MFA | 8.3.1, 8.3.6, 8.4.2 | | audit_log_coverage | missing/unstructured audit logs in payment handlers | 10.2.1 | | check_data_retention | CVV/PAN without TTL, incorrect memory zeroing | 3.2.1, 3.3.1 | | check_payment_page_scripts | CSP, SRI, nonce, FIM for payment pages | 6.4.3, 11.6.1 | | check_dependencies | vulnerable go.mod deps via OSV.dev (offline mode supported) | 6.3.3 | | generate_sbom | CycloneDX 1.6 SBOM with SPDX licenses | 6.3.2 | | triage_findings | AI-assisted prioritization + file:line enrichment | (orchestrator) | Plus generate_compliance_report (full multi-scanner report), update_vulnerability_db (refresh OSV cache), explain_requirement (PCI DSS lookup).

Quick install (Docker)

json
{
  "mcpServers": {
    "pci-dss-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--mount", "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
        "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
      ]
    }
  }
}

src= and dst=

 mirror the same absolute path so the container sees your code at the same path your host uses.

Quick install (Go)


go install github.com/shyshlakov/pci-dss-mcp@v0.6.2



Then add

{"command": "pci-dss-mcp"}

 to your MCP client config.

What pci-dss-mcp is NOT


- Not a replacement for broad SAST (Semgrep, CodeQL, gosec for OWASP-Top-10)
- Not a replacement for LLM-based code review
- Not a QSA replacement: static analysis covers ~6% of PCI DSS v4.0.1; a Qualified Security Assessor must sign off on the rest

Distribution


- MCP Registry:

io.github.shyshlakov/pci-dss-mcp


- Docker:

ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2

 (keyless-signed via cosign + OIDC)
- Go:

go install github.com/shyshlakov/pci-dss-mcp@v0.6.2` - Source: https://github.com/shyshlakov/pci-dss-mcp

License

MIT

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

pci-dss-mcp

What it detects

Quick install (Docker)

Quick install (Go)

What pci-dss-mcp is NOT

Distribution

License

Install

More like this

Sentry

Github

Git

GitLab

Context 7

Playwright