mcp-github-gitlab-pr-security-and-compliance-reviewer
README.md
<!-- COMMERCIAL_LAUNCH_BANNER -->
# mcp-github-gitlab-pr-security-and-compliance-reviewer
> **Zero-Cost Deterministic GitHub & GitLab Pull Request Security, OWASP, WCAG 2.2 AA & SOC 2 Compliance Reviewer MCP Server**
>
> 🌐 **Live Interactive Storefront & Instant URL Grader:** [https://ronanchnlps-bit.github.io](https://ronanchnlps-bit.github.io) | 📊 **200 Live Enterprise Audit Dossiers:** [https://ronanchnlps-bit.github.io/dossiers/index.html](https://ronanchnlps-bit.github.io/dossiers/index.html)
## ⚡ Instant Zero-Install Execution (`npx`)
```bash
npx -y github:ronanchnlps-bit/mcp-github-gitlab-pr-security-and-compliance-reviewer --help
```
## 💳 Commercial Licensing & 48-Hour Done-For-You Remediation Sprints (Zero-Call Async Checkout)
| Tier | Deliverable | Price | Instant Checkout (PayPal / Card) |
| :--- | :--- | :---: | :--- |
| **1. Pro Commercial License** | Unlimited CI/CD & Production Repos + Commercial SARIF/VPAT Export | **$49.00** | [**💳 Buy Pro License ($49.00) →**](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard+Pro+Commercial+License+-+mcp-github-gitlab-pr-security-and-compliance-reviewer&amount=49.00¤cy_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html) |
| **2. Instant Quick-Fix Patch Pack** | Pre-Built Edge Worker + `/llms.txt` + `security.txt` + Draft VPAT 2.5 | **$99.00** | [**🔥 Buy Instant Patch Pack ($99) →**](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard+Instant+Quick-Fix+Patch+Pack+%26+Draft+VPAT+%28mcp-github-gitlab-pr-security-and-compliance-reviewer%29&amount=99.00¤cy_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html) |
| **3. 48-Hour Done-For-You Sprint** | Full Turnkey Pull Request Remediation + Signed ITI VPAT 2.5 ACR + 7-Day SLA | **$1,497.00** | [**⚡ Order 48h Done-For-You Sprint ($1,497) →**](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard+48-Hour+Done-For-You+Compliance+Sprint+%28mcp-github-gitlab-pr-security-and-compliance-reviewer%29&amount=1497.00¤cy_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html) |
| **4. Continuous Monthly Retainer** | Automated Weekly Drift Scans + PR Gatekeeping + Certificate Renewal | **$299/mo** | [**🔄 Activate Monthly Retainer ($299/mo) →**](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick-subscriptions&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard%20Continuous%20Compliance%20Retainer&a3=299.00&p3=1&t3=M&src=1&no_note=1¤cy_code=USD&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html) |
---
# 🛡️ MCP GitHub / GitLab PR Diff Security, Secret Leak & WCAG Compliance Reviewer
> **Commercial-Grade Model Context Protocol (MCP) Server, CLI & Interactive Studio for Automated Pull Request DevSecOps Auditing**
> Inspects unified Git diffs (`.patch` / `git diff`), staged commits, and CI/CD pull request payloads across **4 Simultaneous DevSecOps & Compliance Gates** with **Zero API Cost** and **100% Local Execution**.
[](https://smithery.ai/server/mcp-github-gitlab-pr-security-and-compliance-reviewer)
[](https://glama.ai/mcp/servers/mcp-github-gitlab-pr-security-and-compliance-reviewer)
[](https://www.npmjs.com/package/mcp-github-gitlab-pr-security-and-compliance-reviewer)
[](https://sarifweb.azurewebsites.net/)
[](./LICENSE)
---
## 💼 Commercial Positioning & Problem Solved
Modern engineering teams building with **Claude Desktop, Cursor, Windsurf, and GitHub Copilot** face a compounding PR review bottleneck:
1. **Secret & Key Infiltration**: AI code generation frequently autofills hardcoded API keys (`sk_live_...`, `AKIA...`, `ghp_...`, `eyJ...`) into frontend and backend diffs.
2. **Injection Vulnerabilities**: Accidental unparameterized SQL concatenation, `dangerouslySetInnerHTML` bypasses, and unvalidated SSRF fetches slip past manual reviews.
3. **Accessibility & Regulatory Lawsuits**: Under the **European Accessibility Act (EU EAA)** and **ADA Title II**, missing `alt` tags, keyboard focus removals (`outline-none`), and non-interactive `div` click handlers trigger substantial statutory fines.
4. **EU AI Act Article 50 & Database Exposure**: Added LLM chatbot components lacking mandatory AI transparency notices violate EU Art. 50, and new PostgreSQL tables deployed without **Row Level Security (RLS)** expose private tenant data through PostgREST/GraphQL.
Existing cloud SaaS solutions (Snyk, SonarCloud) charge thousands per seat and require outbound code uploads.
**`mcp-github-gitlab-pr-security-and-compliance-reviewer`** runs **entirely locally on your workstation or CI runner at zero API cost**, delivering instant PR risk scores, committable inline GitHub/GitLab suggestion diffs, and OASIS SARIF v2.1.0 exports.
---
## 🚀 The 4 Simultaneous DevSecOps & Compliance Gates
```
┌────────────────────────────────────────────────────────┐
│ Unified Git Diff (.patch / PR Diff) │
└───────────────────────────┬────────────────────────────┘
│
┌────────────────────────┬───────────────────┴────────────────┬────────────────────────┐
▼ ▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Gate 1 │ │ Gate 2 │ │ Gate 3 │ │ Gate 4 │
│ Secret Leaks │ │ OWASP Top 10 │ │ WCAG 2.2 AA │ │ EU AI Act & │
│ & Credentials │ │ & Injections │ │ & EU EAA │ │ Database RLS │
└───────┬───────┘ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘
│ │ │ │
▼ ▼ ▼ ▼
• AWS AKIA • SQLi Concat • Missing img alt • EU AI Act Art. 50
• Stripe Live • eval() / Function() • Button type/label disclosure notice
• Supabase JWT • Raw dangerous HTML • outline-none focus • CREATE TABLE
• OpenAI/Claude • SSRF fetch(req.query) • div onClick a11y without ENABLE
• GitHub PAT • Path traversal • Undersized targets ROW LEVEL SECURITY
• PEM Private Keys • Insecure Cookies (<44x44px)
│ │ │ │
└────────────────────────┴───────────────────┬────────────────┴────────────────────────┘
│
▼
┌──────────────────────────────────────────┐
│ PR Risk Score (0–100) & Merge Decision │
│ • BLOCK_MERGE_CRITICAL (Score >= 70) │
│ • CHANGES_REQUESTED (Score >= 40) │
│ • APPROVED_WITH_ADVISORIES │
│ • CLEAN_APPROVAL │
└────────────────────┬─────────────────────┘
│
┌────────────────────────────┼────────────────────────────┐
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Committable Fix │ │ GitHub / GitLab │ │ OASIS SARIF │
│ ```suggestion │ │ Markdown Review │ │ v2.1.0 JSON │
└──────────────────┘ └──────────────────┘ └──────────────────┘
```
### Gate 1: Secret & Credential Leak Detection
- **AWS Access Keys**: Identifies `AKIA[0-9A-Z]{16}` and suggests `process.env.AWS_ACCESS_KEY_ID`.
- **Stripe Live Keys**: Intercepts `sk_live_[0-9a-zA-Z]{24,}` and `rk_live_...`.
- **Supabase Service Role JWTs**: Intercepts high-privilege service-role tokens that bypass RLS.
- **AI Model Keys**: Catches OpenAI (`sk-...`, `sk-proj-...`) and Anthropic Claude (`sk-ant-api...`).
- **GitHub PATs**: Detects classic `ghp_...` and fine-grained `github_pat_...` tokens.
- **Slack Incoming Webhooks**: Identifies private team channel webhooks.
- **Private Cryptographic Keys**: Detects committed `-----BEGIN RSA/EC PRIVATE KEY-----`.
- **High-Entropy Secrets**: Analyzes Shannon entropy ($\ge 3.0$) on sensitive key assignments (`api_key`, `secret`, `password`).
### Gate 2: OWASP Top 10 & Injection Vulnerability Scanner
- **SQL Injection (CWE-89 / OWASP A03)**: Catches unparameterized string concatenation and template literal variable interpolations in query executions (`query("SELECT * FROM users WHERE id = '" + id + "'")`). Generates parameterized `$1, $2` replacement diffs.
- **Dynamic Code Execution (CWE-95)**: Flags `eval()`, `new Function()`, and timer string concatenation.
- **Cross-Site Scripting (XSS / CWE-79)**: Intercepts `dangerouslySetInnerHTML` lacking `DOMPurify.sanitize(...)`.
- **Server-Side Request Forgery (SSRF / CWE-918)**: Flags outbound `fetch(req.query.url)` and `axios` calls dispatched without hostname allowlist verification.
- **Path Traversal (CWE-22 / OWASP A01)**: Catches unsanitized file system reads (`fs.readFileSync(path.join('/tmp', req.query.file))`).
- **Insecure Cookies (CWE-614 / OWASP A05)**: Flags `res.cookie()` invocations missing `httpOnly: true` or `secure: true`.
### Gate 3: WCAG 2.2 AA & EU EAA UI Diff Gate
- **Image Accessibility (WCAG 1.1.1 / EU EAA EN 301 549)**: Scans added JSX/TSX/Vue/HTML lines for `<img>` and `<Image>` tags lacking an `alt` attribute.
- **Button Name & Type (WCAG 4.1.2)**: Flags `<button>` elements missing explicit `type="button"|"submit"` or missing accessible screen-reader labels (`aria-label`).
- **Focus Indicator Suppression (WCAG 2.4.7)**: Detects `outline-none` or `focus:outline-none` used without visible focus rings (`focus-visible:ring-2`).
- **Non-Interactive Click Handlers (WCAG 2.1.1)**: Catches `onClick` listeners placed on `<div>` or `<span>` without `role="button"`, `tabIndex`, or keyboard handlers.
- **Touch Target Size (WCAG 2.2 SC 2.5.8)**: Flags undersized buttons (`<44x44px`) lacking required touch padding.
### Gate 4: EU AI Act Art. 50 & Database RLS Diff Gate
- **EU AI Act Article 50 (Transparency Obligations)**: Flags new AI/LLM conversational UI components (`<AiAssistant>`, `<ChatBot>`, `useChat`) that do not disclose to natural persons that they are interacting with an AI system (`aria-label="AI-generated response" data-ai-generated="true"`).
- **PostgreSQL / Supabase Row Level Security (RLS)**: Flags added `CREATE TABLE` DDL migration statements lacking corresponding `ALTER TABLE <name> ENABLE ROW LEVEL SECURITY;`.
---
## 🛠️ MCP Tools Reference (Stdio JSON-RPC 2.0)
When configured inside Claude Desktop, Cursor, or Windsurf, the reviewer exposes **4 Native MCP Tools**:
| MCP Tool Name | Description | Key Parameters |
| :--- | :--- | :--- |
| `review_git_diff` | Full 4-gate audit returning `prRiskScore` (0-100), `mergeDecision`, categorized findings, and a formatted PR review comment. | `diff` (string, required), `failOnSeverity` (`CRITICAL`, `HIGH`, `MEDIUM`) |
| `scan_diff_for_secrets` | Fast credential leak scan returning detected keys and exact `.env` replacement diffs. | `diff` (string, required) |
| `generate_github_pr_suggestions` | Generates committable GitHub/GitLab ` ```suggestion ` blocks mapped to target files and exact new-file line numbers. | `diff` (string, required) |
| `export_pr_sarif_report` | Generates standard OASIS SARIF v2.1.0 JSON format for GitHub Advanced Security and CI/CD code scanning dashboards. | `diff` (string, required), `toolName` (string, optional) |
---
## ⚙️ Quickstart & Installation
### 1. Claude Desktop Configuration
Add to your `claude_desktop_config.json`:
```json
{
"mcpServers": {
"pr-security-reviewer": {
"command": "npx",
"args": ["-y", "mcp-github-gitlab-pr-security-and-compliance-reviewer"]
}
}
}
```
### 2. Cursor IDE Configuration
In **Cursor Settings > Features > MCP**, click **Add New MCP Server**:
- **Name**: `pr-security-reviewer`
- **Type**: `command`
- **Command**: `npx -y mcp-github-gitlab-pr-security-and-compliance-reviewer`
### 3. CLI Usage
Run directly from terminal or in git hooks:
```bash
# Audit active unstaged or staged git diff
git diff | npx mcp-pr-reviewer --fail-on CRITICAL
# Audit PR diff between feature branch and main
git diff origin/main...HEAD | npx mcp-pr-reviewer --format markdown
# Audit a saved .patch file and export SARIF report
npx mcp-pr-reviewer --file ./pr.patch --format sarif --output ./pr-security.sarif.json
# Test with built-in enterprise PR scenario
npx mcp-pr-reviewer --preset 1 --format markdown
# Launch/build interactive Dark UI Studio
npx mcp-pr-reviewer --studio
```
---
## 🤖 GitHub Actions CI/CD Integration
Block insecure pull requests automatically in your repository:
```yaml
# .github/workflows/pr-security-gate.yml
name: PR DevSecOps & Compliance Gate
on:
pull_request:
types: [opened, synchronize, reopened]
jobs:
security-audit:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
security-events: write
steps:
- name: Checkout Code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
- name: Generate PR Unified Diff
run: git diff ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > pr.diff
- name: Run MCP PR Reviewer Audit
run: |
npx mcp-github-gitlab-pr-security-and-compliance-reviewer \
--file pr.diff \
--format sarif \
--output pr-audit.sarif.json \
--fail-on CRITICAL
- name: Upload SARIF to GitHub Code Scanning
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: pr-audit.sarif.json
```
---
## 🎨 Interactive Studio (`dist/mcp-pr-security-studio.html`)
The package includes an **Interactive Dark UI PR Diff Security & Compliance Studio** adhering to strict Frontend Craftsmanship standards:
- **Zero generic AI tropes**: Clean `#090D14` canvas, `#111827` surface, `1px #1E293B` borders, and high-contrast semantic tokens (Emerald `#10B981`, Rose `#F43F5E`, Amber `#F59E0B`, Sky `#0EA5E9`).
- **4 Built-In Enterprise Scenarios**: Switch between critical leaks, AI Act transparency issues, Express SSRF risks, and 100% clean production PRs with one click.
- **In-Browser Diff Auditing**: Paste any custom git diff and audit it instantly in-browser.
- **One-Click Exports**: Copy committable GitHub suggestions, full PR review comments, or download standard SARIF v2.1.0 reports.
To open the studio:
```bash
npm run demo
# Open dist/mcp-pr-security-studio.html in your browser
```
---
## 🧪 Comprehensive Verification Suite
Product 62 is backed by **45 automated tests** covering line number tracking, all 4 gates, committable suggestions, SARIF schema compliance, MCP JSON-RPC protocol, and CLI execution:
```bash
npm test -- --run
```
```
✓ tests/pr-diff-engine.test.js (45)
✓ Unified Git Diff Parsing & Hunk Extraction (6)
✓ Gate 1: Secret & Credential Leak Detection (9)
✓ Gate 2: OWASP Top 10 & Injection Vulnerability Scanner (8)
✓ Gate 3: WCAG 2.2 AA & EU EAA UI Diff Gate (5)
✓ Gate 4: EU AI Act Art. 50 & Database RLS Diff Gate (4)
✓ Risk Scoring, Merge Decisions & Suggestion Formatting (5)
✓ SARIF v2.1.0 Export (2)
✓ MCP Server & Tool Handlers (5)
✓ Interactive Studio HTML Generation (1)
Test Files 1 passed (1)
Tests 45 passed (45)
```
---
## 📄 License & Commercial Support
Licensed under the **MIT License**.
Part of the **Prong 2 Commercial Marketplace Suite**. Available for standalone enterprise licensing, custom gate rule authoring, and private MCP deployment on [Smithery.ai](https://smithery.ai) and [Glama.ai](https://glama.ai).
TDQS
A3.7/5.0
Scored across 4 tools
Disambiguation4/5
The tools target mostly distinct outputs: secret scanning with .env replacements, full diff audit, inline review suggestions, and SARIF export. There is minor potential overlap because review_git_diff performs a broad security audit that may include secret-related findings, but the specialized replacement-diff behavior of scan_diff_for_secrets helps distinguish it.
Naming Consistency5/5
All tool names use snake_case and begin with a clear action verb: scan, review, generate, export. The object/context phrasing varies slightly but remains predictable and readable.
Tool Count5/5
Four tools are well-scoped for a focused PR security and compliance review workflow. Each tool has a distinct role in the pipeline: detect secrets, audit the diff, generate suggestions, and export findings.
Completeness4/5
The surface covers the core review flow from diff input through secret detection, audit, remediation suggestions, and SARIF export. Minor gaps remain around directly fetching PRs/diffs or posting review comments back to GitHub/GitLab, but these may be outside the intended diff-processing scope.
Maintenance
ActivityMaintained
ResponsivenessNo recent community issues