DiffVet Documentation

DiffVet is an autonomous business-risk audit engine for code generated by AI models. It runs as a streamable HTTP Model Context Protocol (MCP) server that connects directly into your AI coding assistants: Claude Code, Cursor, Antigravity, and Windsurf.

Every tool invocation inspects working diffs for lost money, skipped authorization, broken state mutations, race conditions, and unmasked credentials before code ships to main.

Looking for quick connection settings? See Connection Quickstart (/connect).

1. Create an API Key

MCP server access requires an active Pro plan ($15/month). Once subscribed:

  1. Navigate to your Dashboard.
  2. Find the API keys for AI tools card.
  3. Enter a memorable name (e.g. macbook-cursor) and click Create API key.
  4. Copy your new API key immediately — it is shown only once.

Your MCP endpoint URL is: http://localhost:8000/mcp

2. Connect Your AI Assistant

DiffVet speaks standard JSON-RPC 2.0 over HTTP. Choose your tool below to configure the MCP client:

Claude Code

Run the following command in your terminal, replacing YOUR_API_KEY:

claude mcp add --transport http diffvet http://localhost:8000/mcp --header "Authorization: Bearer YOUR_API_KEY"

Cursor

Open Cursor Settings > MCP > Add new server, or edit your configuration file at ~/.cursor/mcp.json:

{
  "mcpServers": {
    "diffvet": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Antigravity

Open Antigravity Settings > MCP Servers and add a new HTTP (remote) server:

Name:    diffvet
URL:     http://localhost:8000/mcp
Header:  Authorization: Bearer YOUR_API_KEY

Windsurf

Open Windsurf Settings > Cascade > MCP servers > Add custom server with the same URL and Authorization: Bearer YOUR_API_KEY header.

3. The 7 Risk-Hunting Tools

Once connected, you can ask your AI assistant in plain English to execute any DiffVet tool on your current git diff:

explain_change

Plain-language walkthrough of the diff citing exact file:line locations so you understand what AI wrote.

Prompt: "Use diffvet to explain this change and walk through execution paths citing file:line."
business_risk_review

Hunts lost money, double charges, missing auth, and state corruption with concrete business impact.

Prompt: "Run a business_risk_review on my current diff before I commit."
scenario_questions

Generates targeted failure-scenario quiz questions and suggested answers citing exact risky lines.

Prompt: "Ask me 3 failure-scenario questions about this diff to check my understanding."
risk_tests

Produces edge-case test specifications and code targeting the specific failure modes introduced in the diff.

Prompt: "Generate risk tests in pytest targeting the high-risk edge cases in this diff."
flow_check

Traces cross-file data flows (payment, auth, or data) and flags where the change breaks business invariants.

Prompt: "Run flow_check on the payment flow to verify idempotency and confirmation."
pre_deploy_checklist

Actionable operational checklist covering database migrations, environment keys, timeouts, and rollback steps.

Prompt: "Produce a pre_deploy_checklist for this change with file:line citations."
security_audit

Audits code for leaked credentials, tokens, private keys, and personal data with severity, line citations, and fixes.

Prompt: "Run security_audit on this diff to check for leaked API keys, tokens, or PII."

4. Test Your Connection

You can test that your API key and MCP server are working directly from your terminal using curl: 

curl -X POST http://localhost:8000/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list"
  }'

If your key is valid and your account is on Pro, DiffVet responds with HTTP 200 and a JSON-RPC payload listing all 7 available tools.

5. Troubleshooting

HTTP 401 Unauthorized

The API key passed in the Authorization: Bearer <key> header is missing, invalid, or revoked. Check your key on the Dashboard or create a new one.

HTTP 402 Payment Required

The account is on the Free plan. MCP editor access is a Pro feature ($15/month). Upgrade on your dashboard or Pricing page to unlock MCP.

Plan Limit Reached

You have exhausted your monthly checks on the shared meter. Free includes 20 checks/month (web and PR reviews); Pro includes 2,000 checks/month across all tools. The meter resets at the beginning of each calendar month.

DiffVet could not parse any changed files from that diff

DiffVet requires valid unified diff format (the output of git diff) or a snippet. Ensure your assistant is passing the diff text rather than file paths or commit hashes.