mcp-github-gitlab-pr-security-and-compliance-reviewer

Zero-Cost Deterministic GitHub & GitLab Pull Request Security, OWASP, WCAG 2.2 AA & SOC 2 Compliance Reviewer MCP Server

🌐 Live Interactive Storefront & Instant URL Grader: https://ronanchnlps-bit.github.io | 📊 200 Live Enterprise Audit Dossiers: https://ronanchnlps-bit.github.io/dossiers/index.html

⚡ Instant Zero-Install Execution (npx)

npx -y github:ronanchnlps-bit/mcp-github-gitlab-pr-security-and-compliance-reviewer --help

Related MCP server: Security & GRC MCP Server

💳 Commercial Licensing & 48-Hour Done-For-You Remediation Sprints (Zero-Call Async Checkout)

🛡️ MCP GitHub / GitLab PR Diff Security, Secret Leak & WCAG Compliance Reviewer

Commercial-Grade Model Context Protocol (MCP) Server, CLI & Interactive Studio for Automated Pull Request DevSecOps Auditing
Inspects unified Git diffs (.patch / git diff), staged commits, and CI/CD pull request payloads across 4 Simultaneous DevSecOps & Compliance Gates with Zero API Cost and 100% Local Execution.

💼 Commercial Positioning & Problem Solved

Modern engineering teams building with Claude Desktop, Cursor, Windsurf, and GitHub Copilot face a compounding PR review bottleneck:

1. Secret & Key Infiltration: AI code generation frequently autofills hardcoded API keys (sk_live_..., AKIA..., ghp_..., eyJ...) into frontend and backend diffs.

2. Injection Vulnerabilities: Accidental unparameterized SQL concatenation, dangerouslySetInnerHTML bypasses, and unvalidated SSRF fetches slip past manual reviews.

3. Accessibility & Regulatory Lawsuits: Under the European Accessibility Act (EU EAA) and ADA Title II, missing alt tags, keyboard focus removals (outline-none), and non-interactive div click handlers trigger substantial statutory fines.

4. EU AI Act Article 50 & Database Exposure: Added LLM chatbot components lacking mandatory AI transparency notices violate EU Art. 50, and new PostgreSQL tables deployed without Row Level Security (RLS) expose private tenant data through PostgREST/GraphQL.

Existing cloud SaaS solutions (Snyk, SonarCloud) charge thousands per seat and require outbound code uploads.
mcp-github-gitlab-pr-security-and-compliance-reviewer runs entirely locally on your workstation or CI runner at zero API cost, delivering instant PR risk scores, committable inline GitHub/GitLab suggestion diffs, and OASIS SARIF v2.1.0 exports.

🚀 The 4 Simultaneous DevSecOps & Compliance Gates

                               ┌────────────────────────────────────────────────────────┐
                               │           Unified Git Diff (.patch / PR Diff)          │
                               └───────────────────────────┬────────────────────────────┘
                                                           │
              ┌────────────────────────┬───────────────────┴────────────────┬────────────────────────┐
              ▼                        ▼                                    ▼                        ▼
      ┌───────────────┐        ┌───────────────┐                    ┌───────────────┐        ┌───────────────┐
      │    Gate 1     │        │    Gate 2     │                    │    Gate 3     │        │    Gate 4     │
      │ Secret Leaks  │        │ OWASP Top 10  │                    │ WCAG 2.2 AA   │        │ EU AI Act &   │
      │ & Credentials │        │  & Injections │                    │  & EU EAA     │        │ Database RLS  │
      └───────┬───────┘        └───────┬───────┘                    └───────┬───────┘        └───────┬───────┘
              │                        │                                    │                        │
              ▼                        ▼                                    ▼                        ▼
         • AWS AKIA               • SQLi Concat                        • Missing img alt        • EU AI Act Art. 50
         • Stripe Live            • eval() / Function()                • Button type/label        disclosure notice
         • Supabase JWT           • Raw dangerous HTML                 • outline-none focus     • CREATE TABLE
         • OpenAI/Claude          • SSRF fetch(req.query)              • div onClick a11y         without ENABLE
         • GitHub PAT             • Path traversal                     • Undersized targets       ROW LEVEL SECURITY
         • PEM Private Keys       • Insecure Cookies                     (<44x44px)
              │                        │                                    │                        │
              └────────────────────────┴───────────────────┬────────────────┴────────────────────────┘
                                                           │
                                                           ▼
                                      ┌──────────────────────────────────────────┐
                                      │ PR Risk Score (0–100) & Merge Decision   │
                                      │ • BLOCK_MERGE_CRITICAL (Score >= 70)     │
                                      │ • CHANGES_REQUESTED    (Score >= 40)     │
                                      │ • APPROVED_WITH_ADVISORIES               │
                                      │ • CLEAN_APPROVAL                         │
                                      └────────────────────┬─────────────────────┘
                                                           │
                              ┌────────────────────────────┼────────────────────────────┐
                              ▼                            ▼                            ▼
                    ┌──────────────────┐         ┌──────────────────┐         ┌──────────────────┐
                    │ Committable Fix  │         │  GitHub / GitLab │         │  OASIS SARIF     │
                    │ ```suggestion    │         │  Markdown Review │         │  v2.1.0 JSON     │
                    └──────────────────┘         └──────────────────┘         └──────────────────┘

Gate 1: Secret & Credential Leak Detection

• AWS Access Keys: Identifies AKIA[0-9A-Z]{16} and suggests process.env.AWS_ACCESS_KEY_ID.

• Stripe Live Keys: Intercepts sk_live_[0-9a-zA-Z]{24,} and rk_live_....

• Supabase Service Role JWTs: Intercepts high-privilege service-role tokens that bypass RLS.

• AI Model Keys: Catches OpenAI (sk-..., sk-proj-...) and Anthropic Claude (sk-ant-api...).

• GitHub PATs: Detects classic ghp_... and fine-grained github_pat_... tokens.

• Slack Incoming Webhooks: Identifies private team channel webhooks.

• Private Cryptographic Keys: Detects committed -----BEGIN RSA/EC PRIVATE KEY-----.

• High-Entropy Secrets: Analyzes Shannon entropy ($\ge 3.0$) on sensitive key assignments (api_key, secret, password).

Gate 2: OWASP Top 10 & Injection Vulnerability Scanner

• SQL Injection (CWE-89 / OWASP A03): Catches unparameterized string concatenation and template literal variable interpolations in query executions (query("SELECT * FROM users WHERE id = '" + id + "'")). Generates parameterized $1, $2 replacement diffs.

• Dynamic Code Execution (CWE-95): Flags eval(), new Function(), and timer string concatenation.

• Cross-Site Scripting (XSS / CWE-79): Intercepts dangerouslySetInnerHTML lacking DOMPurify.sanitize(...).

• Server-Side Request Forgery (SSRF / CWE-918): Flags outbound fetch(req.query.url) and axios calls dispatched without hostname allowlist verification.

• Path Traversal (CWE-22 / OWASP A01): Catches unsanitized file system reads (fs.readFileSync(path.join('/tmp', req.query.file))).

• Insecure Cookies (CWE-614 / OWASP A05): Flags res.cookie() invocations missing httpOnly: true or secure: true.

Gate 3: WCAG 2.2 AA & EU EAA UI Diff Gate

• Image Accessibility (WCAG 1.1.1 / EU EAA EN 301 549): Scans added JSX/TSX/Vue/HTML lines for <img> and <Image> tags lacking an alt attribute.

• Button Name & Type (WCAG 4.1.2): Flags <button> elements missing explicit type="button"|"submit" or missing accessible screen-reader labels (aria-label).

• Focus Indicator Suppression (WCAG 2.4.7): Detects outline-none or focus:outline-none used without visible focus rings (focus-visible:ring-2).

• Non-Interactive Click Handlers (WCAG 2.1.1): Catches onClick listeners placed on <div> or <span> without role="button", tabIndex, or keyboard handlers.

• Touch Target Size (WCAG 2.2 SC 2.5.8): Flags undersized buttons (<44x44px) lacking required touch padding.

Gate 4: EU AI Act Art. 50 & Database RLS Diff Gate

• EU AI Act Article 50 (Transparency Obligations): Flags new AI/LLM conversational UI components (<AiAssistant>, <ChatBot>, useChat) that do not disclose to natural persons that they are interacting with an AI system (aria-label="AI-generated response" data-ai-generated="true").

• PostgreSQL / Supabase Row Level Security (RLS): Flags added CREATE TABLE DDL migration statements lacking corresponding ALTER TABLE <name> ENABLE ROW LEVEL SECURITY;.

🛠️ MCP Tools Reference (Stdio JSON-RPC 2.0)

When configured inside Claude Desktop, Cursor, or Windsurf, the reviewer exposes 4 Native MCP Tools:

⚙️ Quickstart & Installation

1. Claude Desktop Configuration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "pr-security-reviewer": {
      "command": "npx",
      "args": ["-y", "mcp-github-gitlab-pr-security-and-compliance-reviewer"]
    }
  }
}

2. Cursor IDE Configuration

In Cursor Settings > Features > MCP, click Add New MCP Server:

• Name: pr-security-reviewer

• Type: command

• Command: npx -y mcp-github-gitlab-pr-security-and-compliance-reviewer

3. CLI Usage

Run directly from terminal or in git hooks:

# Audit active unstaged or staged git diff
git diff | npx mcp-pr-reviewer --fail-on CRITICAL

# Audit PR diff between feature branch and main
git diff origin/main...HEAD | npx mcp-pr-reviewer --format markdown

# Audit a saved .patch file and export SARIF report
npx mcp-pr-reviewer --file ./pr.patch --format sarif --output ./pr-security.sarif.json

# Test with built-in enterprise PR scenario
npx mcp-pr-reviewer --preset 1 --format markdown

# Launch/build interactive Dark UI Studio
npx mcp-pr-reviewer --studio

🤖 GitHub Actions CI/CD Integration

Block insecure pull requests automatically in your repository:

# .github/workflows/pr-security-gate.yml
name: PR DevSecOps & Compliance Gate

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  security-audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      security-events: write

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Generate PR Unified Diff
        run: git diff ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > pr.diff

      - name: Run MCP PR Reviewer Audit
        run: |
          npx mcp-github-gitlab-pr-security-and-compliance-reviewer \
            --file pr.diff \
            --format sarif \
            --output pr-audit.sarif.json \
            --fail-on CRITICAL

      - name: Upload SARIF to GitHub Code Scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: pr-audit.sarif.json

🎨 Interactive Studio (dist/mcp-pr-security-studio.html)

The package includes an Interactive Dark UI PR Diff Security & Compliance Studio adhering to strict Frontend Craftsmanship standards:

• Zero generic AI tropes: Clean #090D14 canvas, #111827 surface, 1px #1E293B borders, and high-contrast semantic tokens (Emerald #10B981, Rose #F43F5E, Amber #F59E0B, Sky #0EA5E9).

• 4 Built-In Enterprise Scenarios: Switch between critical leaks, AI Act transparency issues, Express SSRF risks, and 100% clean production PRs with one click.

• In-Browser Diff Auditing: Paste any custom git diff and audit it instantly in-browser.

• One-Click Exports: Copy committable GitHub suggestions, full PR review comments, or download standard SARIF v2.1.0 reports.

To open the studio:

npm run demo
# Open dist/mcp-pr-security-studio.html in your browser

🧪 Comprehensive Verification Suite

Product 62 is backed by 45 automated tests covering line number tracking, all 4 gates, committable suggestions, SARIF schema compliance, MCP JSON-RPC protocol, and CLI execution:

npm test -- --run

 ✓ tests/pr-diff-engine.test.js (45)
   ✓ Unified Git Diff Parsing & Hunk Extraction (6)
   ✓ Gate 1: Secret & Credential Leak Detection (9)
   ✓ Gate 2: OWASP Top 10 & Injection Vulnerability Scanner (8)
   ✓ Gate 3: WCAG 2.2 AA & EU EAA UI Diff Gate (5)
   ✓ Gate 4: EU AI Act Art. 50 & Database RLS Diff Gate (4)
   ✓ Risk Scoring, Merge Decisions & Suggestion Formatting (5)
   ✓ SARIF v2.1.0 Export (2)
   ✓ MCP Server & Tool Handlers (5)
   ✓ Interactive Studio HTML Generation (1)

 Test Files  1 passed (1)
      Tests  45 passed (45)

📄 License & Commercial Support

Licensed under the MIT License.
Part of the Prong 2 Commercial Marketplace Suite. Available for standalone enterprise licensing, custom gate rule authoring, and private MCP deployment on Smithery.ai and Glama.ai.