Pci Dss MCP
未认领Narrow-and-deep PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server
安装
docker run -i --rm --mount type=bind,src=/Users/you/go/src,dst=/Users/you/go/src,readonly ghcr.io/shyshlakov/pci-dss-mcp:v0.6.2更多Finance服务器
浏览完整目录安全概况
已认领和已认证的服务器每周接受一次静态扫描，显示代码能触及的范围（外部服务、环境变量、shell 命令、代理配置目录）以及带有已知公告的依赖。认领此列表即可获得。 安全概况的工作原理
14 个工具中显示 14 个
文档中列出的工具 (14)
内容来自项目文档。服务器握手不会验证每个工具的说明或行为。
audit_log_coverage
Missing audit logs on payment flows (10.2.1)
check_auth_strength
Hardcoded passwords, weak policy, missing MFA, webhook signatures (8.3.1, 8.3.6, 8.4.2, 8.6.2)
check_data_retention
Missing TTL, sensitive storage, missing zeroing (3.2.1, 3.3.1)
check_dependencies
Vulnerable Go dependencies via OSV (6.3.3); govulncheck-style privacy: no module names sent to OSV.dev. See docs/checkdependencies.md. Also covers updatevulnerabilitydb.
check_encryption
Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4)
check_error_handling
Error responses leaking sensitive context (6.2.4)
check_payment_page_scripts
Missing CSP/SRI/nonce on payment pages (6.4.3, 11.6.1)
check_secrets_in_configs
Credentials in config files (8.6.2)
check_tls_config
Insecure TLS configs (4.2.1)
explain_requirement
Look up a PCI DSS v4.0.1 requirement by ID
generate_compliance_report
Raw requirement pass/fail report (orchestrator over all scanners)
generate_sbom
CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2)
scan_pan_data
PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1)
triage_findings
All scanners + AI classification + file:line context in one call