PCI DSS v4.0.1 Compliance Checker MCP Server

pci-dss-mcp is a stdio MCP server that runs 12 scanners, an orchestrator, and an AI triage engine over a Go payment service codebase. Each finding carries a requirement_id mapped to a specific PCI DSS v4.0.1 line item; see docs/requirement-mapping.md for the canonical rule-to-requirement table and testdata/vulnerable-payment-service/EXPECTED-FINDINGS.md for live golden output. Its 14 documented tools cover check, generate, data.

People who need finance tools inside Claude, Cursor, VS Code, or another MCP client. The project is written in Go.

VERIFIED ACTIVE

LAST COMMIT 2026-08-24 · ★ 3 · #236 OF 283 MAINTAINED FINANCE · VERIFIED 2026-08-25

MIT · Go servers · how we verify → /methodology

01 · Install PCI DSS v4.0.1 Compliance Checker

Docker

docker run -i --rm ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1

Claude Desktop - add to config

{
  "mcpServers": {
    "shyshlakov-pci-dss-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1"
      ]
    }
  }
}

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as container (OCI image) - can be sandboxed away from your filesystem

license MIT - declared in the repository

registry namespace io.github.shyshlakov is GitHub-verified and matches the repo owner

03 · What PCI DSS v4.0.1 Compliance Checker can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

An agent gets 14 documented tools spanning check, generate, data, including triage_findings, generate_compliance_report, scan_pan_data, check_encryption.

Capability map

Tools grouped from the project's README - what PCI DSS v4.0.1 Compliance Checker lets an agent do.

Check

8 tools - e.g. Weak hashing, hardcoded keys, plain HTTP (4.2.1, 6.2.4); Insecure TLS configs (4.2.1); Credentials in config files (8.6.2)

check_encryption · check_tls_config · check_secrets_in_configs · check_error_handling · check_auth_strength · check_data_retention…

Generate

2 tools - e.g. Raw requirement pass/fail report (orchestrator over all scanners); CycloneDX 1.6 SBOM from go.mod/go.sum (6.3.2)

generate_compliance_report · generate_sbom

Triage

1 tool - e.g. All scanners + AI classification + file:line context in one call

triage_findings

Scan

1 tool - e.g. PAN/SAD storage and logging (3.3.1, 3.4.1, 3.5.1)

scan_pan_data

Audit

1 tool - e.g. Missing audit logs on payment flows (10.2.1)

audit_log_coverage

Explain

1 tool - e.g. Look up a PCI DSS v4.0.1 requirement by ID

explain_requirement

Latest releases

v0.7.1 · 2026-04-29

Highlights · Phase 21.1 closes HTTP input taint coverage gaps surfaced by v0.7.0 dogfood scans on real-world Go payment services. Six engine extensions plus a CRITICAL tier for PAN-validation context, all gated behind…

v0.7.0 · 2026-04-28

Added · HTTP input taint tracking: three new rule IDs detect raw framework input flowing into log, error, and panic sinks without a sanitizer barrier: · - HTTP-INPUT-LOG: framework input flowing into a log sink. PCI…

v0.6.3 · 2026-04-27

The dependency scanner now uses a govulncheck-style privacy model: it bulk-downloads the public OSV Go vulnerability snapshot once and intersects locally against go.mod. Module names (private or public) are no longer…

04 · Who maintains PCI DSS v4.0.1 Compliance Checker

PCI DSS v4.0.1 Compliance Checker is maintained by shyshlakov. It's the only MCP server we track from this author; the repo dates to Apr 2026.

05 · Facts

repository: github.com/shyshlakov/pci-dss-mcp
website: https://github.com/shyshlakov/pci-dss-mcp
category: finance - ranked #236 of 283 actively-maintained finance servers as of 2026-08-25.
registry: io.github.shyshlakov/pci-dss-mcp (active, first published 2026-04-22 · 7 versions)
packages: oci:ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1

06 · PCI DSS v4.0.1 Compliance Checker FAQ

Is PCI DSS v4.0.1 Compliance Checker still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-24. We re-verify nightly.

What can PCI DSS v4.0.1 Compliance Checker do?

An agent gets 14 documented tools spanning check, generate, data, including triage_findings, generate_compliance_report, scan_pan_data, check_encryption.

How do I install PCI DSS v4.0.1 Compliance Checker?

Run `docker run -i --rm ghcr.io/shyshlakov/pci-dss-mcp:v0.7.1`. You can also paste the ready-made client config above.

07 · Alternatives to PCI DSS v4.0.1 Compliance Checker

Alternatives to PCI DSS v4.0.1 Compliance Checker

Maintained finance servers if PCI DSS v4.0.1 Compliance Checker isn't the fit.

Pairs well with

Servers that cover what PCI DSS v4.0.1 Compliance Checker doesn't - only shown when the pairing reason fits the companion.

More finance MCP servers · Bcb Br MCP · DJZS Trust MCP · Knowmint · Fred MCP Server · Sec Edgar MCP

More Go MCP servers · Signadot MCP Server · SigNoz MCP Server · Ckb · Radar · Mcpproxy · see all