io.github.bkalafat/diffpilot
NUGET · DIFFPILOT · SCANNED SEP 20
MCP server for PR code review, commit messages, changelogs, and secret detection.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency47
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 286 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability82
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 956 tokens (~106/item across 9 items; 9 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
How do I install the io.github.bkalafat/diffpilot MCP server?
io.github.bkalafat/diffpilot runs locally as a NuGet package, launched with dnx DiffPilot@1.0.7 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
nuget · DiffPilot
claude mcp add bkalafat-diffpilot -- dnx DiffPilot@1.0.7 --yes
{
"mcpServers": {
"bkalafat-diffpilot": {
"command": "dnx",
"args": [
"DiffPilot@1.0.7",
"--yes"
]
}
}
} {
"servers": {
"bkalafat-diffpilot": {
"command": "dnx",
"args": [
"DiffPilot@1.0.7",
"--yes"
]
}
}
} codex mcp add bkalafat-diffpilot -- dnx DiffPilot@1.0.7 --yes
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"bkalafat-diffpilot": {
"type": "local",
"command": [
"dnx",
"DiffPilot@1.0.7",
"--yes"
],
"enabled": true
}
}
} mcp_servers:
bkalafat-diffpilot:
command: "dnx"
args: ["DiffPilot@1.0.7", "--yes"] {
"McpServers": {
"bkalafat-diffpilot": {
"Transport": "stdio",
"Command": "dnx",
"Arguments": [
"DiffPilot@1.0.7",
"--yes"
]
}
}
} {
"mcpServers": {
"bkalafat-diffpilot": {
"command": "dnx",
"args": [
"DiffPilot@1.0.7",
"--yes"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −3
- Stability: pass → 0.80 functional
- 10 Sept 26 +1
- Stability: 0.97 → pass security
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed nuget/DiffPilot@1.0.7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | nuget |
| Reason | Signature present, unreadable |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
diff_stats ~91
Gets detailed statistics about changes: lines added/removed, files changed, breakdown by file type. Can analyze working directory or branch comparison.
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | Base branch for comparison. If provided, compares branches instead of working directory. |
| featureBranch | string | – | Feature branch for comparison. Defaults to current branch. |
| includeWorkingDir | boolean | – | Include working directory stats (default: true). |
No output schema declared.
No examples provided.
generate_changelog ~104
Generates changelog entries from commits between branches. Categorizes commits into Added, Changed, Fixed, etc. following Keep a Changelog format.
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | Base branch to compare against (default: 'main'). |
| featureBranch | string | – | Feature branch with commits. Defaults to current branch. |
| format | string | – | Output format: 'keepachangelog' (categorized) or 'simple' (flat list). Default: 'keepachangelog'. |
No output schema declared.
No examples provided.
generate_commit_message ~108
Analyzes staged changes (or unstaged if nothing staged) and generates a commit message. Provides diff context and suggests conventional commit format.
| Name | Type | Req | Description |
|---|---|---|---|
| includeBody | boolean | – | Include body section in suggestion (default: true). |
| scope | string | – | Optional scope for conventional commits (e.g., 'api', 'ui', 'auth'). |
| style | string | – | Message style: 'conventional' (feat/fix/chore) or 'simple'. Default: 'conventional'. |
No output schema declared.
No examples provided.
generate_pr_description ~98
Analyzes the diff and generates a complete PR description including summary, list of changes, testing notes, and checklist. Ready to paste into PR.
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | The base branch name (e.g., 'main'). Auto-detected if not provided. |
| includeChecklist | boolean | – | Include a PR checklist (default: true). |
| ticketUrl | string | – | Optional ticket/issue URL to include in the description. |
No output schema declared.
No examples provided.
generate_pr_title ~97
Analyzes the diff and generates a concise, conventional PR title. Returns a suggested title following conventional commit format.
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | The base branch name (e.g., 'main'). Auto-detected if not provided. |
| style | string | – | Title style: 'conventional' (feat/fix/chore), 'descriptive', or 'ticket' (includes branch ticket number). Default: 'conventional'. |
No output schema declared.
No examples provided.
get_pr_diff ~104
Fetches latest from git and returns the diff between base branch and current/feature branch. Auto-detects branches if not specified. Returns raw diff output for any purpose.
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | The base branch name (e.g., 'main'). Auto-detected if not provided. |
| featureBranch | string | – | The feature branch name. Defaults to current branch if not provided. |
| remote | string | – | Git remote name (default: 'origin'). |
No output schema declared.
No examples provided.
review_pr_changes ~87
Gets the PR diff and provides it with instructions for AI code review. Use this when you want to perform a code review on the changes.
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | The base branch name (e.g., 'main'). Auto-detected if not provided. |
| focusAreas | string | – | Optional focus areas for the review (e.g., 'security, performance, error handling'). |
No output schema declared.
No examples provided.
scan_secrets ~68
Scans staged and unstaged changes for accidentally committed secrets, API keys, passwords, tokens, and other sensitive data patterns.
| Name | Type | Req | Description |
|---|---|---|---|
| scanStaged | boolean | – | Scan staged changes (default: true). |
| scanUnstaged | boolean | – | Scan unstaged changes (default: true). |
No output schema declared.
No examples provided.
suggest_tests ~57
Analyzes changed code and suggests appropriate test cases based on detected patterns (async code, error handling, loops, database calls, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| baseBranch | string | – | Base branch for comparison. If not provided, analyzes working directory changes. |
No output schema declared.
No examples provided.
What is the io.github.bkalafat/diffpilot MCP server?
io.github.bkalafat/diffpilot is an MCP server listed in the public MCP registry as io.github.bkalafat/diffpilot. MCP server for PR code review, commit messages, changelogs, and secret detection. This page covers its NuGet package (DiffPilot).
Is the io.github.bkalafat/diffpilot MCP server safe to use?
io.github.bkalafat/diffpilot scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.bkalafat/diffpilot MCP server expose?
io.github.bkalafat/diffpilot exposes 9 tools: get_pr_diff, review_pr_changes, generate_pr_title, generate_pr_description, generate_commit_message, and 4 more. Their descriptions and schemas cost roughly 814 tokens of context every time the server is loaded.
Is the io.github.bkalafat/diffpilot MCP server still maintained?
io.github.bkalafat/diffpilot is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.bkalafat/diffpilot MCP server under?
io.github.bkalafat/diffpilot declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.