DiffSense

io.github.GoldenSupremeSaltedFish由 GitHub 账号 GoldenSupremeSaltedFish 发布v2.3.1更新于 Oct 24, 2026

MR/PR risk audit MCP server: semantic diff + rule engine, strict read-only. Run as image or pip.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

只读的 MCP 服务器，用语义 diff 与规则引擎审计 MR/PR 变更的回归风险，输出评审等级与规则说明。

可以做什么
  • 审计当前 diff 或回放已保存的 diff，得到风险评审等级与建议动作
  • 列出内置规则并解释单条规则检查的内容
  • 输出确定性的机器可读结果，如带版本号的 JSON 契约或 SARIF 2.1.0，供 CI 门禁使用
  • 只分析变更内容，不做全库扫描或代码风格检查
适用场景
适合让助手判断某个拉取或合并请求的 diff 是否引入回归风险，或在 PR 阶段流程与智能体流水线中需要确定性、只读风险信号时使用。
运行要求
以本地 stdio 进程运行，从 PyPI 安装（pip install "diffsense[mcp]"）后用 diffsense-mcp 启动，需要 Python。MCP 服务器本身未声明认证、环境变量或请求头。另外的 GitLab CI 配置使用 DIFFSENSE_TOKEN 变量，GitHub 工作流依赖默认的 GITHUB_TOKEN。
安装前请注意
该 MCP 服务器被描述为严格只读，且不会自动修改 CI 状态，拦截决定仍需人工或下游流程完成。GitLab CI 方式需要具有 api 权限的个人访问令牌并保存为 DIFFSENSE_TOKEN，应勾选掩码，并按机密对待。发送的 diff 内容会被本地工具分析，请留意其中是否含敏感信息。

安装

在 SourceWeft 中

  1. 打开 控制台中的 DiffSense，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

DiffSense

DiffSense is a Change Risk Gate for the PR stage: it evaluates whether the current diff introduces regression risks without performing full codebase scans or style checks. Designed for minimal alerts, high precision, low latency, and interpretable results.

[Version] [License] [VSCode] [Marketplace] [DeepWiki] [Agent]

Quick Start

ScenarioAction
GitHub Pull RequestCopy the workflow from diffsense/docs/quickstart.md (Method 1) to .github/workflows/diffsense.yml in your target repository. Uses the default GITHUB_TOKEN with no additional configuration required. After committing and creating/updating a PR, the workflow will automatically execute the audit and post results under the PR.
Local AuditRun pip install -e diffsense in the repository root, or pip install "git+https://github.com/GoldenSupremeSaltedFish/DiffSense.git@main#subdirectory=diffsense", then execute diffsense replay <path-to-diff>.
Agent / LLM IntegrationInstall the MCP server with pip install "diffsense[mcp]" and run diffsense-mcp, or consume the JSON contract / SARIF directly. See Agent Integration Guide.

Complete steps are available at diffsense/docs/quickstart.md.

Optional: Add .diffsense.yaml to your repository root to use the officially recommended configuration, suitable for most teams.

Features

  • CI / Local: Performs semantic risk auditing on MR/PR diffs, outputting review_level and recommended actions. Analyzes only changed content without slowing down pipelines. Low-quality rules are automatically downgraded. Does not automatically modify CI status; decisions to block are made manually or by downstream processes.
  • Agent / LLM Integration: Deterministic, machine-readable surfaces for agents and CI gates — versioned JSON contract (schema_version), SARIF 2.1.0 output, and a read-only MCP server (audit_diff / audit_replay / list_rules / explain_rule). See the Agent Integration Guide and CLI Contract.
  • VSCode Extension: Maintained in the vscode-extension directory of this repository (dual-artifact layout). Install from the Marketplace or download the VSIX from Releases.

Quick Start (Detailed)

GitHub Actions

Copy the complete YAML from diffsense/docs/quickstart.md (Method 1) to your repository's .github/workflows/diffsense.yml to enable PR auditing.

GitLab CI

  1. In your project, go to Settings → CI/CD → Variables and add the variable DIFFSENSE_TOKEN (Personal Access Token with api permissions; recommended to check Mask variable).
  2. Add the corresponding job to .gitlab-ci.yml. See the example at diffsense/gitlab-ci-example.yml.

VSCode Extension

Maintained in the vscode-extension directory of this repository. Install from the Marketplace or download the VSIX from Releases.

Project Structure (This Branch)

DiffSense/├── diffsense/          # CLI, rule engine, GitHub/GitLab adapters, MCP server; see docs/quickstart.md for quick start├── vscode-extension/   # VS Code extension (dual-artifact line)├── AGENTS.md           # repository guide for AI coding agents└── technical_documentation/

Development

bash
git clone https://github.com/GoldenSupremeSaltedFish/DiffSense.gitcd DiffSense/diffsensepip install -e ".[dev]"pytest tests/ -v

See diffsense/CONTRIBUTING.md for details.

License & Links

English | 中文版（存档）

来源：README.md，提交 81fe7eb

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v2.3.1最新Oct 12, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。