🔍 DiffPilot

Local AI Code Review Before You Push

   

---

💡 Why DiffPilot?

Review your code locally before creating a PR. DiffPilot is an MCP server that lets you:

1. Self-Review Before PR - Run AI code review on your local changes after your last commit, before pushing
2. Reviewer Workflow - As a code reviewer, checkout the source branch locally and get AI-assisted review
3. Auto Branch Detection - No need to specify main - DiffPilot finds your base branch automatically

🔒 100% Local - No cloud, no external APIs. Works with Azure DevOps, TFS, air-gapped environments.

---

🚀 Quick Start

Install

# VS Code Marketplace
ext install BurakKalafat.diffpilot

# Or NuGet (.NET tool)
dotnet tool install -g DiffPilot

Use with GitHub Copilot

# Review my changes (auto-detects base branch)
@workspace #review_pr_changes

# Review with focus areas
@workspace #review_pr_changes focus on security and error handling

# Generate commit message
@workspace #generate_commit_message

# Scan for secrets before committing
@workspace #scan_secrets

---

🛠️ 9 MCP Tools

PR Review Tools

| Tool | Example Prompt | |------|----------------| | #get_pr_diff | "Show diff between my branch and main" | | #review_pr_changes | "Review my PR for security issues" | | #generate_pr_title | "Generate a conventional PR title" | | #generate_pr_description | "Create PR description with checklist" |

Developer Tools

| Tool | Example Prompt | |------|----------------| | #generate_commit_message | "Generate commit message for staged changes" | | #scan_secrets | "Check for API keys in my changes" | | #diff_stats | "Show change statistics" | | #suggest_tests | "What tests should I write?" | | #generate_changelog | "Generate changelog from commits" |

---

✨ Key Features

| Feature | Description | |---------|-------------| | 🔄 Auto Branch Detection | Automatically finds main, master, or develop | | 🔐 Secret Scanning | Detects API keys, passwords, tokens, JWT | | 📊 Diff Statistics | Lines added/removed, file breakdown by type | | 🧪 Test Suggestions | Pattern-based test case recommendations | | 📝 Conventional Commits | Generate feat:, fix:, refactor: messages | | 🛡️ Enterprise Security | Bank-grade input validation, rate limiting, output sanitization |

---

🛡️ Security

DiffPilot implements enterprise-grade security features:

| Security Feature | Description | |-----------------|-------------| | Input Validation | All parameters validated against strict patterns | | Injection Prevention | Command injection, path traversal protection | | Output Sanitization | Auto-redacts secrets from tool outputs | | Rate Limiting | Prevents DoS attacks (120 req/min) | | Secure Errors | No internal details exposed to clients | | Audit Logging | Security events logged to stderr |

Auto-Redacted Patterns: API keys, AWS credentials, GitHub/Slack tokens, JWTs, passwords, private keys, connection strings.

See SECURITY.md for full documentation.

---

📋 Use Cases

1. Self-Review Before PR

# After finishing your work, before creating PR:
@workspace #review_pr_changes

# AI reviews your changes and provides feedback
# Fix issues locally, then push with confidence

2. Code Reviewer Workflow

# Checkout the feature branch locally
git checkout feature/user-auth

# Use DiffPilot to review
@workspace #review_pr_changes focus on security

# Get structured review with AI assistance

3. Pre-Commit Secret Check

@workspace #scan_secrets

# Catches API keys, passwords, tokens before they're committed

---

⚙️ Configuration

{
  "diffpilot.defaultBaseBranch": "main",
  "diffpilot.prTitleStyle": "conventional",
  "diffpilot.commitMessageStyle": "conventional"
}

---

📦 Installation Options

| Method | Command | |--------|---------| | VS Code | ext install BurakKalafat.diffpilot | | NuGet | dotnet tool install -g DiffPilot | | Manual | git clone + dotnet build |

Requirements: .NET 9 SDK, VS Code 1.101+, Git

---

📜 Version History

1.2.0 (2025-12-09)

• Security Hardening - Bank-grade security features
• Input validation (CWE-20)
• Command injection prevention (CWE-78)
• Path traversal protection (CWE-22)
• Output sanitization - auto-redacts secrets (CWE-200)
• Rate limiting (CWE-400)
• Secure error handling
• Added SECURITY.md documentation
• 80 new security unit tests

1.1.5 (2025-12-08)

• Updated README with use cases and #tool prompts
• Highlighted auto branch detection

1.1.4 (2025-12-07)

• Icon refinements

1.1.3 (2025-12-07)

• New extension icon (lens with plus/minus)

1.1.2 (2025-12-07)

• Optimized package size

1.1.1 (2025-12-07)

• Updated extension icon

1.1.0 (2025-12-07)

• Improved tool documentation

1.0.9 (2025-12-07)

• Fixed: Server uses workspace folder for git operations

1.0.8 (2025-12-07)

• Shortened tool descriptions for cleaner UI

1.0.7 (2025-12-07)

• Fixed: Bundled server includes TargetFramework

1.0.6 (2025-12-07)

• Fixed: MCP auto-registration for VS Code 1.101+

1.0.5 (2025-12-07)

• Published to NuGet and MCP Registry

1.0.0 (2025-12-06)

• Initial release with 9 MCP tools

---

📄 License

MIT License - Burak Kalafat

---

GitHub • VS Code Marketplace • NuGet

⭐ Star if useful!