Diffpilot

io.github.bkalafatPublished by GitHub account bkalafatv1.0.7Updated Oct 24, 2026

MCP server for PR code review, commit messages, changelogs, and secret detection.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that lets an assistant review your Git changes, draft PR titles, descriptions and commit messages, and scan diffs for secrets.

What you can do
Inspect diffs and change statistics between your branch and an auto-detected base branch, and review the changes with focus areas such as security or error handling. Draft PR titles and descriptions, including checklists. Generate conventional commit messages and changelogs from commits. Scan changes for API keys, passwords, tokens and other secrets. Suggest test cases based on changed code patterns.
When to use it
Use it to self-review local changes before pushing or opening a pull request, to assist as a reviewer on a checked-out branch, or to check for secrets before committing. Suited to teams on Azure DevOps, TFS, or air-gapped setups who want review help without sending code to a cloud service. It is a desktop-only tool.
Requirements
Runs locally as a .NET tool (dotnet tool install -g DiffPilot) or a VS Code extension. Needs the .NET 9 SDK, Git, and (for the extension) VS Code 1.101 or later. No accounts, API keys, or environment variables are declared.
Before you install
It reads local Git history and working-tree changes, which may include credentials; the README says outputs are auto-redacted and secrets are logged to stderr, so review what reaches the assistant and any logs. It generates text (titles, descriptions, commit messages, changelogs) that you should check before using. No cloud or external API calls are claimed.

Installation

In SourceWeft

  1. Open Diffpilot in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

🔍 DiffPilot

Local AI Code Review Before You Push

[.NET 9] [VS Code] [MCP] [License: MIT]

💡 Why DiffPilot?

Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:

  1. Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
  2. Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
  3. Auto Branch Detection - No need to specify main - DiffPilot finds your base branch automatically

🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.

🚀 Quick Start

Install

bash
# VS Code Marketplaceext install BurakKalafat.diffpilot
# Or NuGet (.NET tool)dotnet tool install -g DiffPilot

Use with GitHub Copilot

# Review my changes (auto-detects base branch)@workspace #review_pr_changes
# Review with focus areas@workspace #review_pr_changes focus on security and error handling
# Generate commit message@workspace #generate_commit_message
# Scan for secrets before committing@workspace #scan_secrets

🛠️ 9 MCP Tools

PR Review Tools

ToolExample Prompt
#get_pr_diff"Show diff between my branch and main"
#review_pr_changes"Review my PR for security issues"
#generate_pr_title"Generate a conventional PR title"
#generate_pr_description"Create PR description with checklist"

Developer Tools

ToolExample Prompt
#generate_commit_message"Generate commit message for staged changes"
#scan_secrets"Check for API keys in my changes"
#diff_stats"Show change statistics"
#suggest_tests"What tests should I write?"
#generate_changelog"Generate changelog from commits"

✨ Key Features

FeatureDescription
🔄 Auto Branch DetectionAutomatically finds main, master, or develop
🔐 Secret ScanningDetects API keys, passwords, tokens, JWT
📊 Diff StatisticsLines added/removed, file breakdown by type
🧪 Test SuggestionsPattern-based test case recommendations
📝 Conventional CommitsGenerate feat:, fix:, refactor: messages
🛡️ Enterprise SecurityBank-grade input validation, rate limiting, output sanitization

🛡️ Security

DiffPilot implements enterprise-grade security features:

Security FeatureDescription
Input ValidationAll parameters validated against strict patterns
Injection PreventionCommand injection, path traversal protection
Output SanitizationAuto-redacts secrets from tool outputs
Rate LimitingPrevents DoS attacks (120 req/min)
Secure ErrorsNo internal details exposed to clients
Audit LoggingSecurity events logged to stderr

Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.

See SECURITY.md for full documentation.

📋 Use Cases

1. Self-Review Before PR

# After finishing your work, before creating PR:@workspace #review_pr_changes
# AI reviews your changes and provides feedback# Fix issues locally, then push with confidence

2. Code Reviewer Workflow

bash
# Checkout the feature branch locallygit checkout feature/user-auth
# Use DiffPilot to review@workspace #review_pr_changes focus on security
# Get structured review with AI assistance

3. Pre-Commit Secret Check

@workspace #scan_secrets
# Catches API keys, passwords, tokens before they're committed

⚙️ Configuration

json
{  "diffpilot.defaultBaseBranch": "main",  "diffpilot.prTitleStyle": "conventional",  "diffpilot.commitMessageStyle": "conventional"}

📦 Installation Options

MethodCommand
VS Codeext install BurakKalafat.diffpilot
NuGetdotnet tool install -g DiffPilot
Manualgit clone + dotnet build

Requirements: .NET 9 SDK, VS Code 1.101+, Git

📜 Version History

1.2.0 (2025-12-09)

  • Security Hardening - Bank-grade security features
    • Input validation (CWE-20)
    • Command injection prevention (CWE-78)
    • Path traversal protection (CWE-22)
    • Output sanitization - auto-redacts secrets (CWE-200)
    • Rate limiting (CWE-400)
    • Secure error handling
  • Added SECURITY.md documentation
  • 80 new security unit tests

1.1.5 (2025-12-08)

  • Updated README with use cases and #tool prompts
  • Highlighted auto branch detection

1.1.4 (2025-12-07)

  • Icon refinements

1.1.3 (2025-12-07)

  • New extension icon (lens with plus/minus)

1.1.2 (2025-12-07)

  • Optimized package size

1.1.1 (2025-12-07)

  • Updated extension icon

1.1.0 (2025-12-07)

  • Improved tool documentation

1.0.9 (2025-12-07)

  • Fixed: Server uses workspace folder for git operations

1.0.8 (2025-12-07)

  • Shortened tool descriptions for cleaner UI

1.0.7 (2025-12-07)

  • Fixed: Bundled server includes TargetFramework

1.0.6 (2025-12-07)

  • Fixed: MCP auto-registration for VS Code 1.101+

1.0.5 (2025-12-07)

  • Published to NuGet and MCP Registry

1.0.0 (2025-12-06)

  • Initial release with 9 MCP tools

📄 License

MIT License - Burak Kalafat

GitHub • VS Code Marketplace • NuGet

⭐ Star if useful!

Source: README.md at commit f3ba53d

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.7LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.