PCI DSS v4.0.1 Compliance Checker

io.github.shyshlakovPublished by GitHub account shyshlakovv0.7.1Updated Oct 24, 2026

PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Static analysis MCP server that scans Go payment service codebases for PCI DSS v4.0.1 violations and maps each finding to a requirement ID.

What you can do
  • Run a full triage of a Go codebase with AI classification and file:line context, or generate a requirement-level pass/fail compliance report
  • Scan for PAN/SAD storage and logging, weak hashing, hardcoded keys, plain HTTP, insecure TLS, and credentials in config files
  • Check authentication strength, error responses leaking sensitive context, audit log coverage, data retention, and payment page CSP/SRI/nonce
  • Check Go dependencies for known vulnerabilities via OSV and generate a CycloneDX SBOM from go.mod/go.sum
  • Look up PCI DSS v4.0.1 requirement text by requirement ID
When to use it
Useful when you maintain a Go payment service and want an assistant to flag payment-specific PCI DSS issues and produce requirement-mapped findings or a compliance report before code ships. It complements, rather than replaces, broad SAST tools, LLM code review, or a QSA sign-off.
Requirements
Runs locally over stdio. Install via Go 1.25+ (1.26.9 or newer recommended) or run the published container image with Docker; the Docker setup bind-mounts your source path read-only. No environment variables, headers, or accounts are declared. Dependency checks contact OSV.dev.
Before you install
The server reads your source tree, so mount or point it only at the intended codebase. Dependency vulnerability checks send data to OSV.dev, though the README says module names are not sent. It is pre-v1.0 and covers only a small share of PCI DSS requirements, so findings are not an audit result.

Installation

In SourceWeft

  1. Open PCI DSS v4.0.1 Compliance Checker in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

pci-dss-mcp

Static analysis MCP server for Go payment service codebases. Every detected PCI DSS v4.0.1 violation in a Go payment service codebase is mapped to the specific requirement number before the code ships.

[CI] [Go Reference] [License: MIT] [OpenSSF Scorecard] [MCP Registry] [pci-dss-mcp MCP server]

What it does

pci-dss-mcp is a stdio MCP server that runs 12 scanners, an orchestrator, and an AI triage engine over a Go payment service codebase. Each finding carries a requirement_id mapped to a specific PCI DSS v4.0.1 line item; see docs/requirement-mapping.md for the canonical rule-to-requirement table and testdata/vulnerable-payment-service/EXPECTED-FINDINGS.md for live golden output.

What pci-dss-mcp catches today

  • HTTP framework input flow into log / error / panic sinks. Tier 1 frameworks (gin, chi, gorilla/mux, net/http (Go 1.22+), echo v4, fiber v2) and Tier 1 loggers (log/slog, logrus, zap, zerolog, logr, klog, hclog) ship in v0.7. Tier 2 (kratos, apex/log, charmbracelet/log) lands in v0.8. Tier 3 (fasthttp, beego, iris, httprouter, project-internal) is user-configurable via Phase 25 YAML once shipped. See docs/http_input_taint.md.

What pci-dss-mcp is NOT

  • Not a replacement for broad SAST. Use Semgrep, CodeQL, or gosec for OWASP Top-10 and language-agnostic vulnerabilities.
  • Not a replacement for LLM-based code review. pci-dss-mcp maps payment-specific issues to PCI DSS requirement IDs; LLM agents catch broad bugs via reasoning. The two layers compose.
  • Not Go-agnostic. Go-specific AST patterns and taint flow tracing are what make the precision possible.
  • Not a QSA replacement. Static analysis covers ~6% of PCI DSS v4.0.1 requirements. A Qualified Security Assessor must sign off on the rest.

Install

Go install (primary)

Requires Go 1.25+; use Go 1.26.9 or newer, because Go 1.25 is past end of life:

bash
go install github.com/shyshlakov/pci-dss-mcp@latest

The binary lands at $(go env GOPATH)/bin/pci-dss-mcp. See docs/install-from-source.md for PATH resolution, the macOS codesign provenance fix, cosign verification, and the MCP client JSON config.

Docker (alternative)

bash
docker pull ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2

Useful for CI pipelines, QSA auditors who do not develop Go locally, or any environment without a host Go toolchain.

MCP Registry

Listed as io.github.shyshlakov/pci-dss-mcp at registry.modelcontextprotocol.io. Auto-published on every tag.

Usage

Add to your MCP client config (Claude Desktop claude_desktop_config.json, Cursor .cursor/mcp.json, or claude mcp add for Claude Code):

json
{  "mcpServers": {    "pci-dss-mcp": {      "command": "docker",      "args": ["run", "-i", "--rm",        "--mount", "type=bind,src=/Users/you/go/src,dst=/Users/you/go/src,readonly",        "ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2"]    }  }}

src= and dst= mirror the same absolute path so the container sees your code at the same path your host uses; prompts pass the normal host path with no translation. For the go install variant and per-client examples, see docs/usage.md.

Two prompts to paste into your MCP client:

  1. Run pci-dss-mcp triage on /Users/you/payments-service. Use min_severity=MEDIUM and group findings by PCI DSS requirement.
  2. Generate a PCI DSS compliance report for /Users/you/payments-service in JSON format. Show requirement-level pass/fail status and severity counts.

Tools

ToolPurposeDocs
triage_findingsAll scanners + AI classification + file:line context in one calldocs/triage_findings.md
generate_compliance_reportRaw requirement pass/fail report (orchestrator over all scanners)docs/generate_compliance_report.md
scan_pan_dataPAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1)docs/scan_pan_data.md
check_encryptionWeak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4)docs/check_encryption.md
check_tls_configInsecure TLS configs (4.2.1)docs/check_tls_config.md
check_secrets_in_configsCredentials in config files (8.6.2)docs/check_secrets_in_configs.md
check_error_handlingError responses leaking sensitive context (6.2.4)docs/check_error_handling.md
check_auth_strengthHardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2)docs/check_auth_strength.md
audit_log_coverageMissing audit logs on payment flows (10.2.1)docs/audit_log_coverage.md
check_data_retentionMissing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1)docs/check_data_retention.md
check_payment_page_scriptsMissing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1)docs/check_payment_page_scripts.md
check_dependenciesVulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See docs/check_dependencies.md. Also covers update_vulnerability_db.docs/check_dependencies.md
generate_sbomCycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2)docs/generate_sbom.md
explain_requirementLook up a PCI DSS v4.0.1 requirement by IDdocs/explain_requirement.md

All tools declare typed OutputSchema. See docs/tools.md for the catalog index and migration history.

Documentation

Status

Active development, pre v1.0. See ROADMAP.md and CHANGELOG.md.

License

MIT, see LICENSE.

pci-dss-mcp is a static analysis tool. It cannot replace a Qualified Security Assessor. Use its output as input to your compliance process, not as the compliance itself.

Source: README.md at commit 98bca66

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.7.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts