check_secrets_in_configs

MCP tool from Pci Dss MCP by shyshlakov

Credentials in config files (8.6.2)

How to use it

Project documentation lists check_secrets_in_configs for the Pci Dss MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Pci Dss MCP

docker run -i --rm --mount type=bind,src=/Users/you/go/src,dst=/Users/you/go/src,readonly ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2

FULL PCI DSS MCP LISTING

Other tools in Pci Dss MCP (13)

audit_log_coverage

Missing audit logs on payment flows (10.2.1)

check_auth_strength

Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2)

check_data_retention

Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1)

check_dependencies

Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See docs/checkdependencies.md. Also covers updatevulnerabilitydb.

check_encryption

Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4)

check_error_handling

Error responses leaking sensitive context (6.2.4)

check_payment_page_scripts

Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1)

check_tls_config

Insecure TLS configs (4.2.1)

explain_requirement

Look up a PCI DSS v4.0.1 requirement by ID

generate_compliance_report

Raw requirement pass/fail report (orchestrator over all scanners)