diff-gatekeeper
PR / Dependency Breaking-Change & Exploit Gatekeeper — Merge gate for a pull request: pass/warn/fail verdict, 0-100 risk score, the top findings with file:line and a fix, drop-in patches, GitHub Checks annotations and a SARIF 2.1.0 log. Accepts a raw unified diff, a GitHub PR, commit or compare URL, or per-file patches. Deterministic scanners (secrets, SQL and command injection, weak crypto, risky package.json changes) run beside a model review for bu
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "diff-gatekeeper"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Alternative to gitDiff: changed files with their patch hunks, as returned by GitHub's pull request files API. | |
| prUrl | No | Alternative to gitDiff: a public GitHub pull request, commit or compare URL (github.com/owner/repo/pull/123). Its .diff is downloaded; a diff over 300,000 characters is cut at a file boundary and the rest reported as unreviewed. | |
| context | No | What the PR is supposed to do. | |
| gitDiff | No | Raw unified diff (git diff output). Provide exactly one of gitDiff, prUrl or files. | |
| packageJsonDiff | No |