Diffpilot

io.github.bkalafat由 GitHub 账号 bkalafat 发布v1.0.7更新于 Oct 24, 2026

MCP server for PR code review, commit messages, changelogs, and secret detection.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

本地 MCP 服务器，让助手审查 Git 改动、起草 PR 标题、描述和提交信息，并扫描差异中的密钥。

可以做什么
查看当前分支与自动识别的基础分支之间的差异和变更统计，并按安全、错误处理等关注点审查改动。起草 PR 标题和描述，包括检查清单。根据提交生成符合约定式提交规范的提交信息和变更日志。扫描改动中的 API 密钥、密码、令牌等敏感信息。根据改动代码的模式建议测试用例。
适用场景
适合在推送或创建 PR 前自查本地改动、作为审查者审查已检出的分支，或在提交前检查是否泄露密钥。也适合使用 Azure DevOps、TFS 或隔离网络环境、希望不把代码发往云服务的团队。仅支持桌面端。
运行要求
以 .NET 工具（dotnet tool install -g DiffPilot）或 VS Code 扩展形式在本地运行。需要 .NET 9 SDK、Git，使用扩展时还需 VS Code 1.101 及以上版本。未声明账号、API 密钥或环境变量。
安装前请注意
它会读取本地 Git 历史和未提交的改动，其中可能包含凭据；README 称输出会自动脱敏、安全事件写入 stderr，因此请留意传给助手的内容和日志。它生成的标题、描述、提交信息和变更日志属于草稿，使用前应人工核对。声称不调用云端或外部 API。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Diffpilot，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

🔍 DiffPilot

Local AI Code Review Before You Push

[.NET 9] [VS Code] [MCP] [License: MIT]

💡 Why DiffPilot?

Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:

  1. Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
  2. Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
  3. Auto Branch Detection - No need to specify main - DiffPilot finds your base branch automatically

🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.

🚀 Quick Start

Install

bash
# VS Code Marketplaceext install BurakKalafat.diffpilot
# Or NuGet (.NET tool)dotnet tool install -g DiffPilot

Use with GitHub Copilot

# Review my changes (auto-detects base branch)@workspace #review_pr_changes
# Review with focus areas@workspace #review_pr_changes focus on security and error handling
# Generate commit message@workspace #generate_commit_message
# Scan for secrets before committing@workspace #scan_secrets

🛠️ 9 MCP Tools

PR Review Tools

ToolExample Prompt
#get_pr_diff"Show diff between my branch and main"
#review_pr_changes"Review my PR for security issues"
#generate_pr_title"Generate a conventional PR title"
#generate_pr_description"Create PR description with checklist"

Developer Tools

ToolExample Prompt
#generate_commit_message"Generate commit message for staged changes"
#scan_secrets"Check for API keys in my changes"
#diff_stats"Show change statistics"
#suggest_tests"What tests should I write?"
#generate_changelog"Generate changelog from commits"

✨ Key Features

FeatureDescription
🔄 Auto Branch DetectionAutomatically finds main, master, or develop
🔐 Secret ScanningDetects API keys, passwords, tokens, JWT
📊 Diff StatisticsLines added/removed, file breakdown by type
🧪 Test SuggestionsPattern-based test case recommendations
📝 Conventional CommitsGenerate feat:, fix:, refactor: messages
🛡️ Enterprise SecurityBank-grade input validation, rate limiting, output sanitization

🛡️ Security

DiffPilot implements enterprise-grade security features:

Security FeatureDescription
Input ValidationAll parameters validated against strict patterns
Injection PreventionCommand injection, path traversal protection
Output SanitizationAuto-redacts secrets from tool outputs
Rate LimitingPrevents DoS attacks (120 req/min)
Secure ErrorsNo internal details exposed to clients
Audit LoggingSecurity events logged to stderr

Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.

See SECURITY.md for full documentation.

📋 Use Cases

1. Self-Review Before PR

# After finishing your work, before creating PR:@workspace #review_pr_changes
# AI reviews your changes and provides feedback# Fix issues locally, then push with confidence

2. Code Reviewer Workflow

bash
# Checkout the feature branch locallygit checkout feature/user-auth
# Use DiffPilot to review@workspace #review_pr_changes focus on security
# Get structured review with AI assistance

3. Pre-Commit Secret Check

@workspace #scan_secrets
# Catches API keys, passwords, tokens before they're committed

⚙️ Configuration

json
{  "diffpilot.defaultBaseBranch": "main",  "diffpilot.prTitleStyle": "conventional",  "diffpilot.commitMessageStyle": "conventional"}

📦 Installation Options

MethodCommand
VS Codeext install BurakKalafat.diffpilot
NuGetdotnet tool install -g DiffPilot
Manualgit clone + dotnet build

Requirements: .NET 9 SDK, VS Code 1.101+, Git

📜 Version History

1.2.0 (2025-12-09)

  • Security Hardening - Bank-grade security features
    • Input validation (CWE-20)
    • Command injection prevention (CWE-78)
    • Path traversal protection (CWE-22)
    • Output sanitization - auto-redacts secrets (CWE-200)
    • Rate limiting (CWE-400)
    • Secure error handling
  • Added SECURITY.md documentation
  • 80 new security unit tests

1.1.5 (2025-12-08)

  • Updated README with use cases and #tool prompts
  • Highlighted auto branch detection

1.1.4 (2025-12-07)

  • Icon refinements

1.1.3 (2025-12-07)

  • New extension icon (lens with plus/minus)

1.1.2 (2025-12-07)

  • Optimized package size

1.1.1 (2025-12-07)

  • Updated extension icon

1.1.0 (2025-12-07)

  • Improved tool documentation

1.0.9 (2025-12-07)

  • Fixed: Server uses workspace folder for git operations

1.0.8 (2025-12-07)

  • Shortened tool descriptions for cleaner UI

1.0.7 (2025-12-07)

  • Fixed: Bundled server includes TargetFramework

1.0.6 (2025-12-07)

  • Fixed: MCP auto-registration for VS Code 1.101+

1.0.5 (2025-12-07)

  • Published to NuGet and MCP Registry

1.0.0 (2025-12-06)

  • Initial release with 9 MCP tools

📄 License

MIT License - Burak Kalafat

GitHub • VS Code Marketplace • NuGet

⭐ Star if useful!

来源：README.md，提交 f3ba53d

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v1.0.7最新Sep 16, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。