PCI DSS v4.0.1 Compliance Checker
If you're building Go payment services and need to ship PCI DSS compliant code, this server runs static analysis against your codebase and maps every violation to a specific v4.0.1 requirement ID. It traces taint flow from HTTP input through major frameworks like gin and chi into log sinks, catches weak crypto and hardcoded keys, flags missing audit logs on payment flows, and scans dependencies for CVEs using the OSV database without leaking module names. The triage_findings tool runs all 12 scanners plus AI classification in one call. It covers about 6% of PCI DSS requirements, the stuff you can catch statically before a QSA audit. Not a replacement for Semgrep or CodeQL, but purpose built for payment code.
- GitHub stars
- 1
- tools
- 14
- transport
- STDIO
- last updated
- Apr 29, 2026
Tools
14 toolsPublic tool metadata for what this MCP can expose to an agent.
triage_findingsAll scanners + AI classification + file:line context in one call
All scanners + AI classification + file:line context in one call
No parameter schema in public metadata yet.
generate_compliance_reportRaw requirement pass/fail report (orchestrator over all scanners)
Raw requirement pass/fail report (orchestrator over all scanners)
No parameter schema in public metadata yet.
scan_pan_dataPAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1)
PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1)
No parameter schema in public metadata yet.
check_encryptionWeak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4)
Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4)
No parameter schema in public metadata yet.
check_tls_configInsecure TLS configs (4.2.1)
Insecure TLS configs (4.2.1)
No parameter schema in public metadata yet.
check_secrets_in_configsCredentials in config files (8.6.2)
Credentials in config files (8.6.2)
No parameter schema in public metadata yet.
check_error_handlingError responses leaking sensitive context (6.2.4)
Error responses leaking sensitive context (6.2.4)
No parameter schema in public metadata yet.
check_auth_strengthHardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2)
Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2)
No parameter schema in public metadata yet.
audit_log_coverageMissing audit logs on payment flows (10.2.1)
Missing audit logs on payment flows (10.2.1)
No parameter schema in public metadata yet.
check_data_retentionMissing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1)
Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1)
No parameter schema in public metadata yet.
check_payment_page_scriptsMissing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1)
Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1)
No parameter schema in public metadata yet.
check_dependenciesVulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. Also covers update_vulnerability_db.
Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. Also covers update_vulnerability_db.
No parameter schema in public metadata yet.
generate_sbomCycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2)
CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2)
No parameter schema in public metadata yet.
explain_requirementLook up a PCI DSS v4.0.1 requirement by ID
Look up a PCI DSS v4.0.1 requirement by ID
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
pci-dss-mcp
Static analysis MCP server for Go payment service codebases. Every detected PCI DSS v4.0.1 violation in a Go payment service codebase is mapped to the specific requirement number before the code ships.
What it does
Details
- Repository
- github.com/shyshlakov/pci-dss-mcp
- Website
- github.com/shyshlakov/pci-dss-mcp
- Category
- Finance & Commerce
- Package
ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1- Transport
- STDIO
- Registry
- MCP registry, active
Related Finance & Commerce MCP servers
View all
Wayforthwayforthofficial/wayforthSearch engine and payment rail for AI agents. 2,300+ services, semantic ranking.1stars
Kaseya Quote Managerwyre-technology/kaseya-quote-manager-mcpRead-only MCP server for Kaseya Quote Manager (Datto Commerce): quotes, orders, purchasing.1stars
ZebPay MCP Serverzebpay/zebpay-mcp-serverMCP server for ZebPay crypto exchange — fetch prices, balances, and manage orders1stars
X402engine Mcpagentc22/x402engine-mcp50+ pay-per-call APIs for AI agents — images, LLM, code, crypto, travel & more via x4020stars
Agentic Shelfvboykocto/agentic-shelfHosted MCP for e-commerce: live product catalog, stock, and pricing for AI agents.0stars
Inferventis MCP Serverbankee-ai/inferventisLoan & mortgage calculator, compound interest, ROI, crypto prices, FX conversion for AI agents.0stars