PCI DSS v4.0.1 Compliance Checker

PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server

Connector by shyshlakov · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 5

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/shyshlakov-pci-dss-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools: 11 read · 2 write · 0 delete · 2 not yet classified
Secrets: None asked for
Install scripts: None found
Runs as: Docker image

Tools by what they do 15

Read from the source code; the running server may list different tools.

Read 11 · Look things up without changing anything.

audit_log_coverage
check_auth_strength
check_data_retention
check_dependencies
check_encryption
check_error_handling
check_payment_page_scripts
check_secrets_in_configs
check_tls_config
explain_requirement
scan_pan_data

Write 2 · Create, change, send or run things.

triage_findings
update_vulnerability_db

Not yet classified 2 · We could not tell from the name and description.

generate_compliance_report
generate_sbom

Network hosts it talks to 4

api.osv.dev · found in code
github.com · found in code
glama.ai · found in code
storage.googleapis.com · found in code

Files it touches

/etc/myapp/config.yaml
/tmp/fresh
/tmp/proj
/tmp/proj/internal/card/game.go
/tmp/proj/internal/payment/core.go
/tmp/resume
/tmp/root
/tmp/root/a/b/c/test/helper.go
/tmp/root/clean/test_dir_exclusion/internal/test/e2e/mock_data.go
/tmp/root/internal/e2e/scenario.go
/tmp/root/internal/integration/stripe.go
/tmp/root/internal/mocks/api.go
/tmp/root/internal/Test/foo.go
/tmp/root/internal/test/helper.go
/tmp/root/my-test-dir/src/foo.go
/tmp/root/pkg/fixtures/data.go
/tmp/root/pkg/int/helper.go
/tmp/root/pkg/integrations/visa.go
/tmp/root/pkg/testing/mock.go
/tmp/root/pkg/testutil/db.go
/tmp/root/test/helper.go
/tmp/root/testdata/fixture/foo.go
/tmp/x
/tmp/y
Your home directory (~)

Tools (15)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

audit_log_coverage
Scan Go source files for payment handlers missing structured audit logging (PCI DSS 10.2.1). Detects: missing logging, unstructured-only logging (fmt/log), and reports handlers with structured logging. Framework-aware: supports net/http, gin, echo handler signatures. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.b…
check_auth_strength
Scan Go source files for weak authentication: hardcoded passwords (PCI DSS 8.3.1), password policy with minimum length below 12 (PCI DSS 8.3.6), and payment routes missing MFA middleware (PCI DSS 8.4.2). Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full pag…
check_data_retention
Scan Go source and config files for unsafe data retention: Redis/DB storage of CVV/PAN without TTL (PCI DSS 3.2.1), config files missing TTL on sensitive keys (PCI DSS 3.3.1), and incorrect memory zeroing timing after authorization. Scans .go, .yaml, .json, .toml files. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summar…
check_dependencies
Scan go.mod dependencies for known vulnerabilities (PCI DSS 6.3.3). Bulk-downloads the public OSV Go vulnerability snapshot and intersects locally against go.mod, matching the govulncheck privacy model. No module names are sent to OSV.dev. Cache TTL: 24h fresh, 24h-7d revalidate via ETag, >7d force-refresh. Run update_vulnerability_db first to bootstrap the cache for air-gapped environments. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 1 per severity findings - plus a pagination.next_cursor for drill-down. Prefer t…
check_encryption
Scan Go source files for encryption violations: weak hash algorithms (md5/sha1) with context scoring, hardcoded encryption keys/IVs, and plain HTTP URLs. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns …
check_error_handling
Scan Go source files for payment handler error disclosure: detects err.Error() in http.Error, fmt.Fprintf with error variables, w.Write with error bytes, and json.Encode of errors. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use includ…
check_payment_page_scripts
Scan Go source files and HTML templates for payment page script security violations (PCI DSS 6.4.3, 11.6.1). Detects: missing Content-Security-Policy headers in Go payment handlers, unsafe-inline/unsafe-eval in CSP, external scripts without SRI (integrity attribute) in HTML templates, inline scripts without nonce attribute. Framework-aware: supports net/http, gin, echo handler signatures. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this…
check_secrets_in_configs
Scan configuration files (.env, .yaml, .json, .toml) for hardcoded secrets: API keys, passwords, tokens, and connection strings with embedded credentials. Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns…
check_tls_config
Scan Go source files for TLS configuration violations: InsecureSkipVerify, weak MinVersion (below TLS 1.2), missing MinVersion, and prohibited cipher suites (RC4, 3DES, NULL). Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tes…
explain_requirement
Look up a PCI DSS v4.0.1 requirement by ID. Returns title, description, and testing procedure.
generate_compliance_report
Raw PCI DSS v4.0.1 compliance report without AI triage — intended for CI gates, audit artifacts, and requirement-level pass/fail lists. For interactive "scan this project" prompts call triage_findings instead. Default unfiltered call returns a compact summary (metadata, totals, requirement_statuses, top 20 findings per severity, cursor for follow-up). Supply min_severity / rule_filter / limit to get a paged flat list (60 per page with cursor), or cursor=<token> to resume a prior session (10-minute TTL). min_severity / rule_filter drop the response to shape "flat" but still carry summary.by_sev…
generate_sbom
Generate a CycloneDX v1.6 SBOM for a Go project. Default behavior: writes sbom.json (or sbom.xml when format=xml) next to the scanned go.mod and returns metadata only (output_path, size_bytes, component_count, unknown_licenses). Override the destination with output_path (must be absolute). Pass inline=true to return the serialized SBOM in the MCP response instead (capped at 64 KB; returns SBOM_TOO_LARGE above that). Parses go.mod + go.sum offline against the local GOMODCACHE; cache-miss modules surface as UNKNOWN-LICENSE. Satisfies PCI DSS 6.3.2 (software inventory, mandatory since March 2025)…
scan_pan_data
Default: returns response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 3 per severity findings - plus a pagination.next_cursor for drill-down. Prefer this for mixed queries; min_severity / rule_filter drop to response_shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list. Use include_tests / exclude_patterns for a filtered flat response. Maps findings to PCI DSS 3.3.1, 3.4.1, 3.5.1.
triage_findings
Run all PCI DSS v4.0.1 scanners + AI-assisted prioritization + file:line enrichment on a Go project in a single call. Default: response_shape "summary" with by_severity counts, a capped by_rule histogram (top 10 + more_rules), and top 1 per severity enriched finding, plus pagination.next_cursor for drill-down. min_severity / rule_filter drop the response to shape "flat" but still carry summary.by_severity + summary.by_rule for full-scan context. Follow the cursor for the full paginated list.
update_vulnerability_db
Download fresh OSV Go vulnerability snapshot to local cache for offline scanning. Downloads from gs://osv-vulnerabilities/Go/all.zip (~7.5MB). This is the ONLY tool that makes network requests. Cache stored at PCI_MCP_CACHE_DIR or ~/.pci-dss-mcp/vuln-cache/ by default.

Signals

Stars: 5
Forks: 0
Open issues: 0
Last commit: Oct 18, 2026 (11 days ago)
Last release: Apr 29, 2026 (6 months ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name: io.github.shyshlakov/pci-dss-mcp
Version: 0.7.1
Auth: No auth
Packages: oci ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1
License: MIT
Repository: github.com/shyshlakov/pci-dss-mcp
Website: github.com/shyshlakov/pci-dss-mcp
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

Cite this page

PCI DSS v4.0.1 Compliance Checker MCP server. Agent Mart. https://agentmart.dev/connectors/shyshlakov-pci-dss-mcp (last updated 2026-10-24)