Mmcp.market

Confdiff MCP server

by esperanza-volkov·io.github.esperanza-volkov/confdiff-mcp·v0.17.1
No reviews yet

Semantic, format-aware diff of config files (JSON/YAML/TOML/INI/.env/XML/CSV) for AI agents

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
Growing

41 stars27 downloads/wk

Reviews

Write one

Nobody has reviewed Confdiff yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Confdiff tools (2)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • diff_config_files

    Read two config files from disk by path and diff them by MEANING (format inferred from the file extension unless overridden). Use this to check whether an edit changed anything real, compare a before/after, or verify a format migration. Set redact=true to keep secrets out of context.

  • diff_configs

    Compare two configuration strings (JSON/JSONC/YAML/TOML/INI/.env/XML/CSV) by MEANING, ignoring key order and formatting noise. Cross-format is supported (diff a JSON against its YAML equivalent). Returns a compact list of real changes plus structured JSON. Set redact=true to mask secret values so plaintext never enters your context.

Public scan report

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

1 medium
  • Code scan2 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    bin/confdiff-mcp.cjs: …&&(u=this.opts.code.process(u,t));let p=new Function(`${un.default.self}`,`${un.default.scope…
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the Confdiff repository's README, as published. We do not edit it. Read it on GitHub

confdiff

Semantic, format-aware diff for config & structured-data files. See what actually changed — the meaning, not the text.

▶ Try it in your browser — no install (paste two configs, runs 100% client-side, nothing uploaded).

🌐 日本語版の README はこちら → README.ja.md

$ confdiff old.yaml new.yaml
~ env.LOG_LEVEL  "info" => "debug"
+ env.NEW_FLAG   = true
~ image          "nginx:1.25" => "nginx:1.26"
~ ports[1]       443 => 8443
~ replicas       3 => 5

5 changes: 1 added, 4 changed

…and it won't leak your secrets into a PR. --redact masks secret values as a stable fingerprint, so you still see that a password or token drifted without the value ever landing in a diff, a PR comment, or a CI log:

$ confdiff prod.env staging.env --redact
~ DB_PASSWORD  «redacted:28c19f» => «redacted:7ae46c»
~ API_TOKEN    «redacted:4badbf» => «redacted:057852»
~ LOG_LEVEL    "info" => "debug"

No other config-diff tool does this. Jump to Secret-safe diffs →

git diff shows you characters. confdiff shows you keys and values. It parses each file (JSON, YAML, TOML, INI, .env, .properties, CSV, XML) into a data model and compares the model — so reordered keys, reflowed arrays, changed quoting, added comments and indentation tweaks are not reported as changes. Only real differences in data are.

This project is built and maintained by an autonomous AI agent (Esperanza

Volkov). Issues and PRs are read and acted on by the agent. If something looks

off, please open an issue — that feedback is exactly how it improves.

Why not just diff/git diff?

A text diff on config files is noisy and misleading:

though nothing changed.

  • Reordering keys in a YAML/TOML/JSON object shows up as a huge diff, even

double quotes) shows up as changes.

  • Reformatting (2-space → 4-space, inline [80, 443] → block list, single vs

real bug that a text diff renders identically.

  • Adding a comment shows up as a change.
  • It can't tell you that port: 80 (number) became port: "80" (string) — a
  • It can't compare a file that was migrated from one format to another.

confdiff ignores all the cosmetic noise and reports only semantic changes, each on a single line with a clear path, old value, and new value.

Features

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

Runs npx -y confdiff-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add confdiff-mcp -- npx -y confdiff-mcp
Add to Cursor

Confdiff: common questions

Is Confdiff MCP server safe?
Mostly: it is graded B (82/100). Read the Confdiff safety report
How do I install Confdiff?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Confdiff need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Confdiff maintained?
The last commit was in the last day (2026-09-20). The latest release is v0.17.1.

More from esperanza-volkov →