DiffSense

io.github.GoldenSupremeSaltedFishPublished by GitHub account GoldenSupremeSaltedFishv2.3.1Updated Oct 24, 2026

MR/PR risk audit MCP server: semantic diff + rule engine, strict read-only. Run as image or pip.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Read-only MCP server that audits merge/pull request diffs for regression risk using a semantic diff and rule engine, returning review levels and rule…

What you can do
  • Audit a diff or replay a saved diff to get a risk review level and recommended actions
  • List the built-in rules and explain what an individual rule checks
  • Produce deterministic, machine-readable output such as a versioned JSON contract or SARIF 2.1.0 for CI gates
  • Analyze only changed content, without full codebase scans or style checks
When to use it
Useful when an assistant should judge whether a pull or merge request diff introduces regression risk, or when you want a deterministic, read-only risk signal inside a PR-stage workflow or agent pipeline.
Requirements
Runs as a local stdio process installed from PyPI (pip install "diffsense[mcp]") and started with diffsense-mcp; Python is required. No authentication, environment variables or headers are declared for the MCP server itself. The separate GitLab CI setup uses a DIFFSENSE_TOKEN variable, and the GitHub workflow relies on the default GITHUB_TOKEN.
Before you install
The MCP server is described as strict read-only and does not change CI status, so blocking decisions stay manual or downstream. The GitLab CI path asks for a personal access token with api permissions stored as DIFFSENSE_TOKEN, which should be masked; treat that token as a secret. Review the diff content you send, since it is analyzed locally by the tool.

Installation

In SourceWeft

  1. Open DiffSense in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

DiffSense

DiffSense is a Change Risk Gate for the PR stage: it evaluates whether the current diff introduces regression risks without performing full codebase scans or style checks. Designed for minimal alerts, high precision, low latency, and interpretable results.

[Version] [License] [VSCode] [Marketplace] [DeepWiki] [Agent]

Quick Start

ScenarioAction
GitHub Pull RequestCopy the workflow from diffsense/docs/quickstart.md (Method 1) to .github/workflows/diffsense.yml in your target repository. Uses the default GITHUB_TOKEN with no additional configuration required. After committing and creating/updating a PR, the workflow will automatically execute the audit and post results under the PR.
Local AuditRun pip install -e diffsense in the repository root, or pip install "git+https://github.com/GoldenSupremeSaltedFish/DiffSense.git@main#subdirectory=diffsense", then execute diffsense replay <path-to-diff>.
Agent / LLM IntegrationInstall the MCP server with pip install "diffsense[mcp]" and run diffsense-mcp, or consume the JSON contract / SARIF directly. See Agent Integration Guide.

Complete steps are available at diffsense/docs/quickstart.md.

Optional: Add .diffsense.yaml to your repository root to use the officially recommended configuration, suitable for most teams.

Features

  • CI / Local: Performs semantic risk auditing on MR/PR diffs, outputting review_level and recommended actions. Analyzes only changed content without slowing down pipelines. Low-quality rules are automatically downgraded. Does not automatically modify CI status; decisions to block are made manually or by downstream processes.
  • Agent / LLM Integration: Deterministic, machine-readable surfaces for agents and CI gates — versioned JSON contract (schema_version), SARIF 2.1.0 output, and a read-only MCP server (audit_diff / audit_replay / list_rules / explain_rule). See the Agent Integration Guide and CLI Contract.
  • VSCode Extension: Maintained in the vscode-extension directory of this repository (dual-artifact layout). Install from the Marketplace or download the VSIX from Releases.

Quick Start (Detailed)

GitHub Actions

Copy the complete YAML from diffsense/docs/quickstart.md (Method 1) to your repository's .github/workflows/diffsense.yml to enable PR auditing.

GitLab CI

  1. In your project, go to Settings → CI/CD → Variables and add the variable DIFFSENSE_TOKEN (Personal Access Token with api permissions; recommended to check Mask variable).
  2. Add the corresponding job to .gitlab-ci.yml. See the example at diffsense/gitlab-ci-example.yml.

VSCode Extension

Maintained in the vscode-extension directory of this repository. Install from the Marketplace or download the VSIX from Releases.

Project Structure (This Branch)

DiffSense/├── diffsense/          # CLI, rule engine, GitHub/GitLab adapters, MCP server; see docs/quickstart.md for quick start├── vscode-extension/   # VS Code extension (dual-artifact line)├── AGENTS.md           # repository guide for AI coding agents└── technical_documentation/

Development

bash
git clone https://github.com/GoldenSupremeSaltedFish/DiffSense.gitcd DiffSense/diffsensepip install -e ".[dev]"pytest tests/ -v

See diffsense/CONTRIBUTING.md for details.

License & Links

English | 中文版（存档）

Source: README.md at commit 81fe7eb

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v2.3.1LatestOct 12, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.