mcp-github-gitlab-pr-security-and-compliance-reviewer
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| review_git_diffA | Performs a full multi-gate DevSecOps and compliance audit of a unified git diff (.patch / git diff / PR payload). Returns prRiskScore (0-100), mergeDecision (BLOCK_MERGE_CRITICAL, CHANGES_REQUESTED, APPROVED_WITH_ADVISORIES, CLEAN_APPROVAL), categorized findings, and a formatted GitHub review comment. |
| scan_diff_for_secretsB | Scans added git diff lines for hardcoded credentials (AWS, Stripe, Supabase JWT, OpenAI, Anthropic, GitHub PAT, Slack webhooks, PEM keys, high-entropy secrets) and returns exact .env replacement diffs. |
| generate_github_pr_suggestionsB | Generates committable GitHub/GitLab inline review suggestions (```suggestion blocks) mapped to exact target files and new-file line numbers for all security, injection, WCAG, and AI Act compliance findings. |
| export_pr_sarif_reportB | Converts git diff audit results into standard OASIS SARIF v2.1.0 format for native integration into GitHub Advanced Security, GitLab Code Quality, and CI/CD security dashboards. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| DevSecOps & Compliance Gate Reference | Reference catalog of all 4 security and compliance gates, rule definitions, CWE mappings, WCAG criteria, and severity levels. |
TDQS
Scored across 4 tools
The tools target mostly distinct outputs: secret scanning with .env replacements, full diff audit, inline review suggestions, and SARIF export. There is minor potential overlap because review_git_diff performs a broad security audit that may include secret-related findings, but the specialized replacement-diff behavior of scan_diff_for_secrets helps distinguish it.
All tool names use snake_case and begin with a clear action verb: scan, review, generate, export. The object/context phrasing varies slightly but remains predictable and readable.
Four tools are well-scoped for a focused PR security and compliance review workflow. Each tool has a distinct role in the pipeline: detect secrets, audit the diff, generate suggestions, and export findings.
The surface covers the core review flow from diff input through secret detection, audit, remediation suggestions, and SARIF export. Minor gaps remain around directly fetching PRs/diffs or posting review comments back to GitHub/GitLab, but these may be outside the intended diff-processing scope.