PCI DSS MCP

Name: PCI DSS MCP
Author: shyshlakov

@shyshlakov

PCI DSS MCP について

PCI DSS v4.0.1 static-analysis MCP server for Go payment service codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation. Each finding maps to the exact PCI requirement. A

#security #compliance #pci-dss #static-analysis #golang #payments #audit #encryption #sbom

基本情報

カテゴリ

開発者ツール

トランスポート

stdio

公開者

shyshlakov

投稿者

Oleksandr

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "pci-dss-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--mount",
        "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
        "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
      ]
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is PCI DSS MCP?

Static-analysis MCP server that detects PCI DSS v4.0.1 violations in Go payment service codebases. Every finding maps to a specific PCI DSS requirement number. Built for developers, QSAs, and CI gates.

How to use PCI DSS MCP?

Install via Docker (mount your Go source read-only) or go install github.com/shyshlakov/[email protected]. Add the corresponding command to your MCP client configuration (e.g., pci-dss-mcp or the docker run command).

Key features of PCI DSS MCP?

PAN/CVV storage, masking, and zeroing detection
Weak encryption and hardcoded key checks
TLS misconfiguration auditing (cipher, version)
Secrets and credentials in configuration detection
Missing or unstructured audit log identification
Dependency vulnerability scanning via OSV.dev (offline)

Use cases of PCI DSS MCP?

Pre-commit scanning for developers writing payment code
Pre-assessment scans for Qualified Security Assessors (QSAs)
CI/CD pipeline gates to block PCI DSS violations before deploy
Automated generation of PCI DSS compliance reports
AI-assisted triage of findings for prioritized remediation

FAQ from PCI DSS MCP

Is PCI DSS MCP a replacement for broad SAST or a QSA?

No. It only covers about 6% of PCI DSS v4.0.1 controls. It is not a replacement for Semgrep, CodeQL, gosec for OWASP Top 10, or a Qualified Security Assessor.

How do I install and configure PCI DSS MCP?

Use Docker (ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2) with a bind mount to your Go source, or install via go install. Then add the command to your MCP client config.