Diffpilot

io.github.bkalafat由 GitHub 帳號 bkalafat 發布v1.0.7更新於 Oct 24, 2026

MCP server for PR code review, commit messages, changelogs, and secret detection.

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

本機 MCP 伺服器，讓助手審查 Git 變更、草擬 PR 標題、描述與提交訊息，並掃描差異中的機密資訊。

可以做什麼
檢視目前分支與自動辨識的基礎分支之間的差異與變更統計，並依安全性、錯誤處理等重點審查變更。草擬 PR 標題與描述，包含檢查清單。依提交產生符合慣例式提交規範的提交訊息與變更日誌。掃描變更中的 API 金鑰、密碼、權杖等機密資訊。依變更程式碼的模式建議測試案例。
適用情境
適合在推送或建立 PR 前自行審查本機變更、以審查者身分審查已檢出的分支，或在提交前檢查是否外洩機密資訊。也適合使用 Azure DevOps、TFS 或隔離網路環境、希望不把程式碼送往雲端服務的團隊。僅支援桌面端。
執行需求
以 .NET 工具（dotnet tool install -g DiffPilot）或 VS Code 擴充功能形式在本機執行。需要 .NET 9 SDK、Git，使用擴充功能時還需 VS Code 1.101 以上版本。未宣告帳號、API 金鑰或環境變數。
安裝前請注意
它會讀取本機 Git 歷史與尚未提交的變更，其中可能包含憑證；README 稱輸出會自動遮蔽、安全事件寫入 stderr，因此請留意傳給助手的內容與日誌。它產生的標題、描述、提交訊息與變更日誌屬於草稿，使用前應人工核對。聲稱不呼叫雲端或外部 API。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Diffpilot，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

🔍 DiffPilot

Local AI Code Review Before You Push

[.NET 9] [VS Code] [MCP] [License: MIT]

💡 Why DiffPilot?

Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:

  1. Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
  2. Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
  3. Auto Branch Detection - No need to specify main - DiffPilot finds your base branch automatically

🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.

🚀 Quick Start

Install

bash
# VS Code Marketplaceext install BurakKalafat.diffpilot
# Or NuGet (.NET tool)dotnet tool install -g DiffPilot

Use with GitHub Copilot

# Review my changes (auto-detects base branch)@workspace #review_pr_changes
# Review with focus areas@workspace #review_pr_changes focus on security and error handling
# Generate commit message@workspace #generate_commit_message
# Scan for secrets before committing@workspace #scan_secrets

🛠️ 9 MCP Tools

PR Review Tools

ToolExample Prompt
#get_pr_diff"Show diff between my branch and main"
#review_pr_changes"Review my PR for security issues"
#generate_pr_title"Generate a conventional PR title"
#generate_pr_description"Create PR description with checklist"

Developer Tools

ToolExample Prompt
#generate_commit_message"Generate commit message for staged changes"
#scan_secrets"Check for API keys in my changes"
#diff_stats"Show change statistics"
#suggest_tests"What tests should I write?"
#generate_changelog"Generate changelog from commits"

✨ Key Features

FeatureDescription
🔄 Auto Branch DetectionAutomatically finds main, master, or develop
🔐 Secret ScanningDetects API keys, passwords, tokens, JWT
📊 Diff StatisticsLines added/removed, file breakdown by type
🧪 Test SuggestionsPattern-based test case recommendations
📝 Conventional CommitsGenerate feat:, fix:, refactor: messages
🛡️ Enterprise SecurityBank-grade input validation, rate limiting, output sanitization

🛡️ Security

DiffPilot implements enterprise-grade security features:

Security FeatureDescription
Input ValidationAll parameters validated against strict patterns
Injection PreventionCommand injection, path traversal protection
Output SanitizationAuto-redacts secrets from tool outputs
Rate LimitingPrevents DoS attacks (120 req/min)
Secure ErrorsNo internal details exposed to clients
Audit LoggingSecurity events logged to stderr

Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.

See SECURITY.md for full documentation.

📋 Use Cases

1. Self-Review Before PR

# After finishing your work, before creating PR:@workspace #review_pr_changes
# AI reviews your changes and provides feedback# Fix issues locally, then push with confidence

2. Code Reviewer Workflow

bash
# Checkout the feature branch locallygit checkout feature/user-auth
# Use DiffPilot to review@workspace #review_pr_changes focus on security
# Get structured review with AI assistance

3. Pre-Commit Secret Check

@workspace #scan_secrets
# Catches API keys, passwords, tokens before they're committed

⚙️ Configuration

json
{  "diffpilot.defaultBaseBranch": "main",  "diffpilot.prTitleStyle": "conventional",  "diffpilot.commitMessageStyle": "conventional"}

📦 Installation Options

MethodCommand
VS Codeext install BurakKalafat.diffpilot
NuGetdotnet tool install -g DiffPilot
Manualgit clone + dotnet build

Requirements: .NET 9 SDK, VS Code 1.101+, Git

📜 Version History

1.2.0 (2025-12-09)

  • Security Hardening - Bank-grade security features
    • Input validation (CWE-20)
    • Command injection prevention (CWE-78)
    • Path traversal protection (CWE-22)
    • Output sanitization - auto-redacts secrets (CWE-200)
    • Rate limiting (CWE-400)
    • Secure error handling
  • Added SECURITY.md documentation
  • 80 new security unit tests

1.1.5 (2025-12-08)

  • Updated README with use cases and #tool prompts
  • Highlighted auto branch detection

1.1.4 (2025-12-07)

  • Icon refinements

1.1.3 (2025-12-07)

  • New extension icon (lens with plus/minus)

1.1.2 (2025-12-07)

  • Optimized package size

1.1.1 (2025-12-07)

  • Updated extension icon

1.1.0 (2025-12-07)

  • Improved tool documentation

1.0.9 (2025-12-07)

  • Fixed: Server uses workspace folder for git operations

1.0.8 (2025-12-07)

  • Shortened tool descriptions for cleaner UI

1.0.7 (2025-12-07)

  • Fixed: Bundled server includes TargetFramework

1.0.6 (2025-12-07)

  • Fixed: MCP auto-registration for VS Code 1.101+

1.0.5 (2025-12-07)

  • Published to NuGet and MCP Registry

1.0.0 (2025-12-06)

  • Initial release with 9 MCP tools

📄 License

MIT License - Burak Kalafat

GitHub • VS Code Marketplace • NuGet

⭐ Star if useful!

來源：README.md，提交 f3ba53d

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.0.7最新Sep 16, 2026

評分

已滿足適用檢查項的 40%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。