PCI DSS MCP

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The project uses standard Git development. Every commit is visible in the main branch history at https://github.com/shyshlakov/pci-dss-mcp/commits/main

Commits leading up to release v0.1.0 are preserved and reviewable. Future development between releases will continue to land as individual commits through pull requests against main. Branch protection on main requires status checks and does not allow force-push overwrites of history.

Repository on GitHub, which uses git. git is distributed.

The project follows Semantic Versioning 2.0.0. Each release is identified by a unique vMAJOR.MINOR.PATCH Git tag. The first public release is tagged v0.1.0. URL: https://github.com/shyshlakov/pci-dss-mcp/releases/tag/v0.1.0

Tags are created as annotated Git tags with metadata. The Go module proxy and checksum database enforce tag immutability. A tag cannot be reused for a different release.

Each release is identified by an annotated Git tag in the repository. The v0.1.0 release has an annotated tag visible at https://github.com/shyshlakov/pci-dss-mcp/releases/tag/v0.1.0 and in the Git tag list at https://github.com/shyshlakov/pci-dss-mcp/tags

Non-trivial release notes file in repository: https://github.com/shyshlakov/pci-dss-mcp/blob/main/CHANGELOG.md.

v0.1.0 is the first public release. There were no publicly known vulnerabilities with a CVE assignment in the project results at the time of this release. The release notes still include an explicit Security section confirming no run-time vulnerabilities are fixed in this release and that govulncheck runs clean against the dependency set. URL: https://github.com/shyshlakov/pci-dss-mcp/releases/tag/v0.1.0

Non-trivial SECURITY[.md] file found file in repository: https://github.com/shyshlakov/pci-dss-mcp/blob/main/SECURITY.md. [osps_do_02_01]

The project uses GitHub Issues as its issue tracker. URL: https://github.com/shyshlakov/pci-dss-mcp/issues

CONTRIBUTING.md directs bug reports and feature requests to GitHub Issues. SECURITY.md documents a private channel for vulnerability reports so security issues do not land in the public tracker

The project was published with its first public release v0.1.0 on 2026-04-15. No bug reports have been submitted yet. CONTRIBUTING.md sets an expected initial response time of approximately one week for contributions and bug reports. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/CONTRIBUTING.md#contribution-process

Tracker state at time of submission: https://github.com/shyshlakov/pci-dss-mcp/issues

The project was published with its first public release v0.1.0 on 2026-04-15. No enhancement requests have been submitted yet. The maintainer will respond to incoming enhancement requests through the same GitHub Issues channel used for bug reports. URL: https://github.com/shyshlakov/pci-dss-mcp/issues

GitHub Issues serves as the public searchable archive for all bug reports and responses. Every issue has a stable URL. All comments are preserved. The archive covers both open and closed issues and is searchable by full-text query, labels, author, and status. URL: https://github.com/shyshlakov/pci-dss-mcp/issues?q=is%3Aissue

The project publishes its vulnerability reporting process in SECURITY.md at the root of the repository. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/SECURITY.md

GitHub also surfaces the policy in the repository Security tab and exposes a "Report a vulnerability" entry point at https://github.com/shyshlakov/pci-dss-mcp/security

SECURITY.md documents two private channels for vulnerability reports.

The preferred channel is GitHub Security Advisories. Reporters submit through the form at https://github.com/shyshlakov/pci-dss-mcp/security/advisories/new which keeps the report confidential until a fix is released.

The alternative channel is direct email to the maintainer with the address listed in commit history. The required information is documented (description, reproduction steps, affected versions, severity assessment).

Initial response is committed within 72 hours. Full disclosure process is documented in SECURITY.md. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/SECURITY.md#reporting-a-vulnerability

No vulnerability reports have been received yet. The project was published on 2026-04-15. SECURITY.md publicly commits to an initial response within 72 hours of any incoming vulnerability report. This is well within the 14-day requirement. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/SECURITY.md#reporting-a-vulnerability

Non-trivial build file in repository: https://github.com/shyshlakov/pci-dss-mcp/blob/main/Makefile.

Non-trivial build file in repository: https://github.com/shyshlakov/pci-dss-mcp/blob/main/Makefile.

The project builds using only FLOSS tooling. The Go toolchain (BSD-style license) compiles the binary via go build. GNU Make (GPL) orchestrates the build through the Makefile. CI verifies buildability on Ubuntu and macOS runners using only the public Go installation. No proprietary tools are required at any step. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/Makefile

The project uses an automated test suite built on Go's standard testing package (BSD-style license FLOSS) with the race detector enabled. Custom test fixtures under testdata/ are released as MIT FLOSS along with the rest of the project.

How to run is documented in CONTRIBUTING.md under "Running tests" with the make test and make test-fixture commands. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/CONTRIBUTING.md#running-tests

The CI workflow at .github/workflows/ci.yml shows the exact invocation used in continuous integration on Ubuntu and macOS runners. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/.github/workflows/ci.yml

The test suite is invoked using the canonical Go testing command go test with the standard ./... package pattern. The Makefile target make test wraps go test ./... -count=1 -race to enable the race detector and disable the test cache. Both make test and direct go test ./... work and are documented in CONTRIBUTING.md. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/Makefile

The test suite achieves 83.7 percent statement coverage across 20+ packages measured by go test -coverprofile. Per-package coverage ranges from 71.6 percent
(scanner/auditscanner) to 100 percent (internal/analysis). Every production package has test files. No package is untested.

In addition to unit tests the project includes a fixture-driven regression suite at testdata/vulnerable-payment-service/ that contains 52 intentional violations covering every detection rule end-to-end. The acceptance test at scanner/reportscanner/fixture_test.go enforces the contract on every CI run. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/scanner/reportscanner/fixture_test.go

The project runs continuous integration via GitHub Actions on every push to main and every pull request. Five workflows are configured. CI runs the test suite on Ubuntu and macOS under the race detector with a coverage job. Lint runs golangci-lint. govulncheck checks the dependency tree against the Go vulnerability database. CodeQL performs static security analysis. OpenSSF Scorecard performs supply-chain checks.

Branch protection on main requires 6 required status checks to pass before any merge. URL: https://github.com/shyshlakov/pci-dss-mcp/tree/main/.github/workflows

CONTRIBUTING.md documents a formal binding policy under "Running tests". Any patch that adds removes or reclassifies a scanner detection finding must update the fixture testdata/vulnerable-payment-service/ and EXPECTED-FINDINGS.md in the same commit. The required workflow is RED then GREEN. First update the expectation and confirm make test-fixture fails. Then implement the change and confirm the fixture passes again with no regressions.

The policy is enforced by CI. The fixture acceptance test runs on every pull request and main push. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/CONTRIBUTING.md#running-tests

Evidence is visible in the current state of the repository. The project contains 90 test files distributed across 20 packages outside testdata/. Every production package has at least one test file. No package is left untested.

In addition the project includes a fixture-driven regression suite at testdata/vulnerable-payment-service/ with a machine-readable EXPECTED-FINDINGS.md contract. The fixture was built up alongside scanner development. Every detection rule that landed in v0.1.0 added a corresponding fixture fragment and an EXPECTED-FINDINGS.md entry. The fixture acceptance test at scanner/reportscanner/fixture_test.go runs on every CI build.

Continuous integration runs the full test suite on every push to main and every pull request. URL: https://github.com/shyshlakov/pci-dss-mcp/actions/workflows/ci.yml

The test policy is documented in CONTRIBUTING.md which is the project's canonical instructions document for change proposals. The "Running tests" section explicitly states the fixture TDD cycle for any patch that adds removes or reclassifies a scanner detection finding. The "Contribution process" section also includes running the test suite locally as a required pre-PR step. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/CONTRIBUTING.md#running-tests

The project enables four FLOSS static analysis tools all wired into CI as required status checks.

go vet runs through the make vet target. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/Makefile

golangci-lint runs in .github/workflows/lint.yml on every push and pull request. It bundles errcheck govet ineffassign staticcheck unused and other linters.

govulncheck runs in .github/workflows/govulncheck.yml against the live dependency tree.

GitHub CodeQL runs in .github/workflows/codeql.yml with the security-and-quality query suite.

All four are required status checks in branch protection on main. URL: https://github.com/shyshlakov/pci-dss-mcp/tree/main/.github/workflows

All four linter workflows (go vet, golangci-lint, govulncheck, CodeQL) are required status checks in branch protection on main. A warning from any of them blocks the merge. The current state of main has zero outstanding warnings. URL: https://github.com/shyshlakov/pci-dss-mcp/actions

CONTRIBUTING.md prohibits silent error suppression. The Code style section requires either handling errors or logging them via slog. Suppressed scanner findings emit a SUPPRESSED record with the reason rather than disappearing.

Recent evidence: incorrect GitHub Actions SHA pins were detected by the Scorecard workflow and fixed in commit f12e951 within the same session.

The .golangci.yml configuration enables a curated strict linter set with default: none and explicit enable list. Enabled linters include errcheck govet staticcheck ineffassign unused misspell gocyclo unconvert and bodyclose. Formatters gofmt and goimports are enforced. URL:
https://github.com/shyshlakov/pci-dss-mcp/blob/main/.golangci.yml

Output settings are maximum strict. max-issues-per-linter is 0 (unlimited) and max-same-issues is 0 (unlimited). All findings are reported with no truncation.

Practical exclusions cover testdata/vulnerable-payment-service/ which is intentionally vulnerable Go code used as the regression fixture and would generate noise. Test files have relaxed gocyclo errcheck and unparam rules to accommodate idiomatic Go test patterns.

The project's primary developer designs and maintains a PCI DSS v4.0.1 static-analysis scanner, which requires working knowledge of common attack surfaces and secure-design principles. The scanner rules implemented in the project directly encode secure-design patterns including least-privilege authentication, input validation, cryptographic agility, TLS configuration hardening, PAN data handling, audit logging, secure error handling, session management, and supply-chain dependency verification. The developer also applied secure-development conventions to the project itself: SHA-pinned GitHub Actions, branch protection with required status checks, govulncheck in CI, CodeQL static analysis, OpenSSF Scorecard, Dependabot alerts, and a documented vulnerability disclosure process in SECURITY.md.

The primary developer is building a static analysis scanner whose purpose is to detect common vulnerability classes in Go payment services. The scanner rule inventory is a direct, code-level catalogue of common error kinds and their mitigations. Representative examples:

• Hardcoded credentials and high-entropy secrets in config files. Mitigation: environment variables and secret managers, enforced by SEC-PREFIX, SEC-HIGH-ENTROPY, SEC-CONNSTR, SEC-CREDENTIAL-KEY rules.
• Insecure TLS configuration (InsecureSkipVerify, missing MinVersion, weak versions, weak ciphers). Mitigation: explicit TLS 1.2+ with curated cipher suite, enforced by TLS-INSECURE-SKIP-VERIFY, TLS-MISSING-MIN-VERSION, TLS-WEAK-VERSION, TLS-WEAK-CIPHER rules.
• Weak or broken cryptography (MD5, SHA1, hardcoded keys, plain HTTP for CHD). Mitigation: SHA-256 or stronger, KMS-provided keys, HTTPS-only transport, enforced by CRYPTO-WEAK-HASH, CRYPTO-HARDCODED-KEY, CRYPTO-PLAIN-HTTP rules.
• PAN data leakage to logs, databases, and error responses. Mitigation: masking, tokenization, memory zeroing, enforced by the PAN scanner rules combined with taint-aware data-flow analysis that downgrades transit-only CHD and keeps storage-bound CHD at HIGH severity.
• Weak authentication (hardcoded passwords, missing MFA, weak password policy). Mitigation: MFA enforcement and strong password policy, enforced by AUTH-HARDCODED-PWD, AUTH-WEAK-POLICY, AUTH-MISSING-MFA, AUTH-BYTE-COUNT rules.
• Missing audit logging on payment flows. Mitigation: structured logging middleware with PCI DSS 10.2.1 field coverage (timestamp, event type, user identification, outcome, affected resource), verified by the audit scanner.
• Error handling that leaks internal detail to HTTP responses. Mitigation: generic client-facing errors with internal detail logged only. Enforced by ERR-LEAK-DIRECT,
  ERR-LEAK-FORMAT, ERR-LEAK-WRITE, ERR-LEAK-ENCODE rules.
• Unsafe payment page scripts (missing CSP, missing SRI, inline scripts, weak nonces). Mitigation: strict CSP with nonces or hashes plus SRI on external scripts, enforced by the script scanner rules.
• Vulnerable dependencies with published CVEs. Mitigation: OSV.dev advisory database lookup via the dep scanner and govulncheck in CI.
• Data retention violations (no TTL on CHD caches, missing memory zeroing). Mitigation: TTL enforcement and explicit zeroing hooks, enforced by the retention scanner rules.
• SQL schemas that store sensitive columns without encryption. Mitigation: encryption-at-rest via GORM hooks, enforced by SQL-SENSITIVE-COLUMN, SQL-TEXT-TYPE, GORM-SENSITIVE-TAG, GORM-NO-ENCRYPT-HOOK rules.

Each rule in the scanner encodes both a vulnerability class and a concrete mitigation technique.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

The project does not publish or rely on externally retrieved cryptographic hashes for verification. Binary installation via go install github.com/shyshlakov/pci-dss-mcp@v0.1.0 retrieves the module from the Go module proxy over HTTPS and verifies it against the SHA-256 hash stored in the public Go checksum database (sum.golang.org), which is itself accessed over HTTPS and backed by a transparent log.

Source distribution is via HTTPS Git clone or SSH. GitHub Release tarballs and zip archives are served over HTTPS directly from github.com.

No build step or installation instruction in the project fetches a hash file over plain HTTP.

There are zero known vulnerabilities in the project at the time of this badge submission. The project is a first public release (v0.1.0) cut on 2026-04-15 and no CVE has been assigned against it.

Dependency scanning runs on every CI build via govulncheck against the Go vulnerability database. The most recent main build (commit bd170c6) passed govulncheck with no findings. URL: https://github.com/shyshlakov/pci-dss-mcp/actions/workflows/govulncheck.yml

Dependabot security alerts and automated security fixes are enabled on the repository to surface and remediate any future advisories that affect the dependency tree.

No critical vulnerabilities have been reported in the project since it became public on 2026-04-15. SECURITY.md documents an initial response commitment of 72 hours for any incoming vulnerability report and a 4-step disclosure process that includes fix development on a private branch followed by coordinated disclosure. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/SECURITY.md#disclosure-process

Dependency-level vulnerabilities are detected automatically by Dependabot security alerts, govulncheck in CI, and OpenSSF Scorecard. Automated security fixes are enabled so that patched dependency versions are proposed as pull requests without manual intervention.

The repository contains no real private credentials that grant access to any system. A public release scrub was performed before the repository was made public, covering 50+ paranoid patterns including API keys, AWS access keys, private keys, tokens, connection strings, and internal hostnames.

The testdata/vulnerable-payment-service/ fixture does contain intentionally hardcoded strings that look like credentials. These are synthetic Go source fixtures used as the golden regression suite for the scanner's own detectors (SEC-PREFIX, SEC-HIGH-ENTROPY, SEC-CONNSTR, SEC-CREDENTIAL-KEY). They are not valid credentials to any live system and grant no access to anything. SECURITY.md explicitly marks this directory as out of scope for security reports. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/SECURITY.md#scope

The repository is also scanned continuously by GitHub Secret Scanning, which is enabled by default on public repositories and actively alerts maintainers if any real provider credential pattern is detected.

The project runs four FLOSS static analysis tools in CI on every push and every pull request, including the release commit for v0.1.0.

golangci-lint bundles errcheck, govet, staticcheck, ineffassign, unused, misspell, gocyclo, unconvert, and bodyclose. Configuration is at .golangci.yml. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/.golangci.yml

GitHub CodeQL runs the Go security-and-quality query suite. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/.github/workflows/codeql.yml

govulncheck performs reachability-aware CVE scanning via the Go vulnerability database. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/.github/workflows/govulncheck.yml

OpenSSF Scorecard runs supply-chain static checks. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/.github/workflows/scorecard.yml

All four are wired into branch protection as required status checks.

CodeQL security-and-quality query suite includes rules for common Go vulnerability patterns including SQL injection, command injection, path traversal, XSS, unsafe deserialization, hardcoded credentials, weak cryptography, and unsafe random number generation.

staticcheck (bundled via golangci-lint) includes bug pattern checks SA1000 through SA9999 covering resource leaks, nil dereferences, incorrect error handling, and misuse of stdlib APIs.

govulncheck maps the Go vulnerability database to reachable code paths in the project, flagging any dependency CVE that the project actually exercises.

bodyclose catches missing HTTP response Body close calls which can lead to resource leaks and connection exhaustion.

errcheck catches unchecked error returns which often mask security-relevant failures.

The main branch currently has zero outstanding static analysis findings. All four analysis workflows (golangci-lint, CodeQL, govulncheck, OpenSSF Scorecard) pass on commit bd170c6. URL: https://github.com/shyshlakov/pci-dss-mcp/actions

Branch protection on main requires these checks to pass before any merge, so a medium or higher severity finding cannot accumulate on main. Any discovered finding must be addressed in the same pull request that surfaces it.

Static analysis runs on every commit. All four analysis workflows (golangci-lint, CodeQL, govulncheck, OpenSSF Scorecard) are triggered on every push to main and every pull request. CodeQL, govulncheck, and Scorecard are additionally scheduled on a weekly cron to catch newly published vulnerabilities in the dependency tree even when no code change is pushed. URL: https://github.com/shyshlakov/pci-dss-mcp/tree/main/.github/workflows

The project runs the Go race detector as its dynamic analysis tool. make test invokes go test ./... -count=1 -race which enables runtime data-race detection across every test in the suite. The race detector is a dynamic tool that instruments memory accesses and detects concurrent read/write hazards at runtime.

CI runs this configuration on every push and every pull request on both Ubuntu and macOS runners. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/.github/workflows/ci.yml

The project is written entirely in Go, which is a memory-safe language with bounds-checked arrays, automatic garbage collection, and no pointer arithmetic. The project does not use cgo and does not link against any C or C++ code. This criterion does not apply.

The Go race detector is an assertion-enabling dynamic analysis mode. Enabling -race instruments every memory access and triggers a runtime failure on any detected data race, in addition to the standard test assertions. CI runs the full test suite under -race on every push and pull request. Race detector builds are significantly slower and more memory-intensive than production builds and are never shipped as the distributed binary. URL: https://github.com/shyshlakov/pci-dss-mcp/blob/main/Makefile

No medium or higher severity exploitable findings have been discovered by dynamic analysis. The Go race detector has reported zero data races on the most recent main build. CI test runs under -race pass on both Ubuntu and macOS. URL: https://github.com/shyshlakov/pci-dss-mcp/actions/workflows/ci.yml