CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
35.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
20.0 pts
Maintenancestaleness, pinning, CI
15%
15.0 pts
TransparencySKILL.md, perms, README
15%
15.0 pts
Communityinstalls, verify, response
15%
15.0 pts
Findings & checks · 0 flagged
Security
✓—All security checks passedNo findings in this category for the latest scan.pass
Supply chain
✓—All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenance
✓—All maintenance checks passedNo findings in this category for the latest scan.pass
Transparency
✓—All transparency checks passedNo findings in this category for the latest scan.pass
Community
✓—All community checks passedNo findings in this category for the latest scan.pass
Every scanned point with the score it earned and what moved between them.
f3ba53d
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
🔍 DiffPilot
Local AI Code Review Before You Push
💡 Why DiffPilot?
Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:
- Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
- Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
- Auto Branch Detection - No need to specify
main- DiffPilot finds your base branch automatically
🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.
🚀 Quick Start
Install
# VS Code Marketplace
ext install BurakKalafat.diffpilot
# Or NuGet (.NET tool)
dotnet tool install -g DiffPilotUse with GitHub Copilot
# Review my changes (auto-detects base branch)
@workspace #review_pr_changes
# Review with focus areas
@workspace #review_pr_changes focus on security and error handling
# Generate commit message
@workspace #generate_commit_message
# Scan for secrets before committing
@workspace #scan_secrets🛠️ 9 MCP Tools
PR Review Tools
| Tool | Example Prompt |
|---|---|
#get_pr_diff | "Show diff between my branch and main" |
#review_pr_changes | "Review my PR for security issues" |
#generate_pr_title | "Generate a conventional PR title" |
#generate_pr_description | "Create PR description with checklist" |
Developer Tools
| Tool | Example Prompt |
|---|---|
#generate_commit_message | "Generate commit message for staged changes" |
#scan_secrets | "Check for API keys in my changes" |
#diff_stats | "Show change statistics" |
#suggest_tests | "What tests should I write?" |
#generate_changelog | "Generate changelog from commits" |
✨ Key Features
| Feature | Description |
|---|---|
| 🔄 Auto Branch Detection | Automatically finds main, master, or develop |
| 🔐 Secret Scanning | Detects API keys, passwords, tokens, JWT |
| 📊 Diff Statistics | Lines added/removed, file breakdown by type |
| 🧪 Test Suggestions | Pattern-based test case recommendations |
| 📝 Conventional Commits | Generate feat:, fix:, refactor: messages |
| 🛡️ Enterprise Security | Bank-grade input validation, rate limiting, output sanitization |
🛡️ Security
DiffPilot implements enterprise-grade security features:
| Security Feature | Description |
|---|---|
| Input Validation | All parameters validated against strict patterns |
| Injection Prevention | Command injection, path traversal protection |
| Output Sanitization | Auto-redacts secrets from tool outputs |
| Rate Limiting | Prevents DoS attacks (120 req/min) |
| Secure Errors | No internal details exposed to clients |
| Audit Logging | Security events logged to stderr |
Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.
See SECURITY.md for full documentation.
📋 Use Cases
1. Self-Review Before PR
# After finishing your work, before creating PR:
@workspace #review_pr_changes
# AI reviews your changes and provides feedback
# Fix issues locally, then push with confidence2. Code Reviewer Workflow
# Checkout the feature branch locally
git checkout feature/user-auth
# Use DiffPilot to review
@workspace #review_pr_changes focus on security
# Get structured review with AI assistance3. Pre-Commit Secret Check
@workspace #scan_secrets
# Catches API keys, passwords, tokens before they're committed⚙️ Configuration
{
"diffpilot.defaultBaseBranch": "main",
"diffpilot.prTitleStyle": "conventional",
"diffpilot.commitMessageStyle": "conventional"
}📦 Installation Options
| Method | Command |
|---|---|
| VS Code | ext install BurakKalafat.diffpilot |
| NuGet | dotnet tool install -g DiffPilot |
| Manual | git clone + dotnet build |
Requirements: .NET 9 SDK, VS Code 1.101+, Git
📜 Version History
1.2.0 (2025-12-09)
- Security Hardening - Bank-grade security features
- Input validation (CWE-20)
- Command injection prevention (CWE-78)
- Path traversal protection (CWE-22)
- Output sanitization - auto-redacts secrets (CWE-200)
- Rate limiting (CWE-400)
- Secure error handling
- Added SECURITY.md documentation
- 80 new security unit tests
1.1.5 (2025-12-08)
- Updated README with use cases and
#toolprompts - Highlighted auto branch detection
1.1.4 (2025-12-07)
- Icon refinements
1.1.3 (2025-12-07)
- New extension icon (lens with plus/minus)
1.1.2 (2025-12-07)
- Optimized package size
1.1.1 (2025-12-07)
- Updated extension icon
1.1.0 (2025-12-07)
- Improved tool documentation
1.0.9 (2025-12-07)
- Fixed: Server uses workspace folder for git operations
1.0.8 (2025-12-07)
- Shortened tool descriptions for cleaner UI
1.0.7 (2025-12-07)
- Fixed: Bundled server includes TargetFramework
1.0.6 (2025-12-07)
- Fixed: MCP auto-registration for VS Code 1.101+
1.0.5 (2025-12-07)
- Published to NuGet and MCP Registry
1.0.0 (2025-12-06)
- Initial release with 9 MCP tools
📄 License
MIT License - Burak Kalafat
[GitHub](https://github.com/bkalafat/DiffPilot) • [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=BurakKalafat.diffpilot) • [NuGet](https://www.nuget.org/packages/DiffPilot)
⭐ Star if useful!