Advertise
MCP.so
Sign In

PCI DSS MCP Server

@shyshlakov

Repository

Basic information

Category

Developer Tools

Transports

stdio

Author

shyshlakov

Submitted by

Oleksandr

About PCI DSS MCP Server

PCI DSS v4.0.1 static-analysis MCP server for Go payment service codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation. Each finding maps to the exact PCI requirement. A

#security#compliance#pci-dss#static-analysis#golang#payments#audit#encryption#sbom

PCI DSS MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "pci-dss-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--mount",
        "type=bind,src=/path/to/your/go/src,dst=/path/to/your/go/src,readonly",
        "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"
      ]
    }
  }
}

PCI DSS MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is PCI DSS MCP?

Static-analysis MCP server that detects PCI DSS v4.0.1 violations in Go payment service codebases. Every finding maps to a specific PCI DSS requirement number. Built for developers, QSAs, and CI gates.

How to use PCI DSS MCP?

Install via Docker (mount your Go source read-only) or go install github.com/shyshlakov/pci-dss-mcp@v0.6.2. Add the corresponding command to your MCP client configuration (e.g., pci-dss-mcp or the docker run command).

Key features of PCI DSS MCP?

  • PAN/CVV storage, masking, and zeroing detection
  • Weak encryption and hardcoded key checks
  • TLS misconfiguration auditing (cipher, version)
  • Secrets and credentials in configuration detection
  • Missing or unstructured audit log identification
  • Dependency vulnerability scanning via OSV.dev (offline)

Use cases of PCI DSS MCP?

  • Pre-commit scanning for developers writing payment code
  • Pre-assessment scans for Qualified Security Assessors (QSAs)
  • CI/CD pipeline gates to block PCI DSS violations before deploy
  • Automated generation of PCI DSS compliance reports
  • AI-assisted triage of findings for prioritized remediation

Frequently asked questions

1

Is PCI DSS MCP a replacement for broad SAST or a QSA?

No. It only covers about 6% of PCI DSS v4.0.1 controls. It is not a replacement for Semgrep, CodeQL, gosec for OWASP Top 10, or a Qualified Security Assessor.

2

How do I install and configure PCI DSS MCP?

Use Docker (`ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2`) with a bind mount to your Go source, or install via `go install`. Then add the command to your MCP client config.

3

What does PCI DSS MCP scan?

It runs 12 scanners over Go source code and configuration files, each mapped to specific PCI DSS requirement numbers (e.g., 3.3.1, 4.2.1, 8.6.2, 10.2

Comments

More Developer Tools MCP servers

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

1

Official Porkbun MCP Server

Porkbun LLC

Official Porkbun MCP server, maintained by Porkbun. Check domain availability and pricing, register, renew and transfer domains, and manage DNS records, nameservers, URL forwarding, glue records, DNSSEC and domain contac

32

Crawl Readiness

Grubbomatic

AI SEO tools for MCP clients — audit whether AI crawlers can read a website, validate JSON-LD and robots.txt, and generate llms.txt, AI-crawler-aware robots.txt, and JSON-LD schema without leaving the conversation.

Mcp-Warden

ermoluk

Local-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.

4

9apes

9apes

The 9apes MCP server lets an AI assistant read the GitHub Actions data 9apes already collects for your organization: runs, jobs, steps, and their durations. Ask it why a build got slower, which jobs take the longest, or

Advertise