English Français العربية

io.github.bkalafat/diffpilot

السجل الرسمي أدوات المطورين

MCP server for PR code review, commit messages, changelogs, and secret detection.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

NUGET package DiffPilot
Claude Code 
claude mcp add diffpilot -- dnx DiffPilot@1.0.7 --yes
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "diffpilot": {
            "command": "dnx",
            "args": [
                "DiffPilot@1.0.7",
                "--yes"
            ]
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. 🔍 DiffPilot
  2. 💡 Why DiffPilot?
  3. 🚀 Quick Start
  4. 🛠️ 9 MCP Tools
  5. ✨ Key Features
  6. 🛡️ Security
  7. 📋 Use Cases
  8. ⚙️ Configuration
  9. 📦 Installation Options
  10. 📜 Version History
  11. 📄 License

🔍 DiffPilot

Local AI Code Review Before You Push

💡 Why DiffPilot?

Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:

  1. Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
  2. Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
  3. Auto Branch Detection - No need to specify main - DiffPilot finds your base branch automatically

🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.

🚀 Quick Start

Install
# VS Code Marketplace
ext install BurakKalafat.diffpilot

# Or NuGet (.NET tool)
dotnet tool install -g DiffPilot
Use with GitHub Copilot
# Review my changes (auto-detects base branch)
@workspace #review_pr_changes

# Review with focus areas
@workspace #review_pr_changes focus on security and error handling

# Generate commit message
@workspace #generate_commit_message

# Scan for secrets before committing
@workspace #scan_secrets

🛠️ 9 MCP Tools

PR Review Tools
ToolExample Prompt
#get_pr_diff"Show diff between my branch and main"
#review_pr_changes"Review my PR for security issues"
#generate_pr_title"Generate a conventional PR title"
#generate_pr_description"Create PR description with checklist"
Developer Tools
ToolExample Prompt
#generate_commit_message"Generate commit message for staged changes"
#scan_secrets"Check for API keys in my changes"
#diff_stats"Show change statistics"
#suggest_tests"What tests should I write?"
#generate_changelog"Generate changelog from commits"

✨ Key Features

FeatureDescription
🔄 Auto Branch DetectionAutomatically finds main, master, or develop
🔐 Secret ScanningDetects API keys, passwords, tokens, JWT
📊 Diff StatisticsLines added/removed, file breakdown by type
🧪 Test SuggestionsPattern-based test case recommendations
📝 Conventional CommitsGenerate feat:, fix:, refactor: messages
🛡️ Enterprise SecurityBank-grade input validation, rate limiting, output sanitization

🛡️ Security

DiffPilot implements enterprise-grade security features:

Security FeatureDescription
Input ValidationAll parameters validated against strict patterns
Injection PreventionCommand injection, path traversal protection
Output SanitizationAuto-redacts secrets from tool outputs
Rate LimitingPrevents DoS attacks (120 req/min)
Secure ErrorsNo internal details exposed to clients
Audit LoggingSecurity events logged to stderr

Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.

See SECURITY.md for full documentation.

📋 Use Cases

1. Self-Review Before PR
# After finishing your work, before creating PR:
@workspace #review_pr_changes

# AI reviews your changes and provides feedback
# Fix issues locally, then push with confidence
2. Code Reviewer Workflow
# Checkout the feature branch locally
git checkout feature/user-auth

# Use DiffPilot to review
@workspace #review_pr_changes focus on security

# Get structured review with AI assistance
3. Pre-Commit Secret Check
@workspace #scan_secrets

# Catches API keys, passwords, tokens before they're committed

⚙️ Configuration

{
  "diffpilot.defaultBaseBranch": "main",
  "diffpilot.prTitleStyle": "conventional",
  "diffpilot.commitMessageStyle": "conventional"
}

📦 Installation Options

MethodCommand
VS Codeext install BurakKalafat.diffpilot
NuGetdotnet tool install -g DiffPilot
Manualgit clone + dotnet build

Requirements: .NET 9 SDK, VS Code 1.101+, Git

📜 Version History

1.2.0 (2025-12-09)
  • Security Hardening - Bank-grade security features
    • Input validation (CWE-20)
    • Command injection prevention (CWE-78)
    • Path traversal protection (CWE-22)
    • Output sanitization - auto-redacts secrets (CWE-200)
    • Rate limiting (CWE-400)
    • Secure error handling
  • Added SECURITY.md documentation
  • 80 new security unit tests
1.1.5 (2025-12-08)
  • Updated README with use cases and #tool prompts
  • Highlighted auto branch detection
1.1.4 (2025-12-07)
  • Icon refinements
1.1.3 (2025-12-07)
  • New extension icon (lens with plus/minus)
1.1.2 (2025-12-07)
  • Optimized package size
1.1.1 (2025-12-07)
  • Updated extension icon
1.1.0 (2025-12-07)
  • Improved tool documentation
1.0.9 (2025-12-07)
  • Fixed: Server uses workspace folder for git operations
1.0.8 (2025-12-07)
  • Shortened tool descriptions for cleaner UI
1.0.7 (2025-12-07)
  • Fixed: Bundled server includes TargetFramework
1.0.6 (2025-12-07)
  • Fixed: MCP auto-registration for VS Code 1.101+
1.0.5 (2025-12-07)
  • Published to NuGet and MCP Registry
1.0.0 (2025-12-06)
  • Initial release with 9 MCP tools

📄 License

MIT License - Burak Kalafat

GitHub • VS Code Marketplace • NuGet

⭐ Star if useful!

الأسئلة الشائعة

ما هو io.github.bkalafat/diffpilot؟

MCP server for PR code review, commit messages, changelogs, and secret detection.

كيف أثبّت io.github.bkalafat/diffpilot؟

يعمل على جهازك. في Claude Code: claude mcp add diffpilot -- dnx DiffPilot@1.0.7 --yes. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج io.github.bkalafat/diffpilot إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل io.github.bkalafat/diffpilot مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون io.github.bkalafat/diffpilot؟

ينشره bkalafat. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.