Confdiff MCP server
io.github.esperanza-volkov/confdiff-mcp·v0.17.1·41 starsSemantic, format-aware diff of config files (JSON/YAML/TOML/INI/.env/XML/CSV) for AI agents
41 stars34 downloads/wk
Reviews
Write oneNobody has reviewed Confdiff yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Confdiff tools (2)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
diff_config_filesRead two config files from disk by path and diff them by MEANING (format inferred from the file extension unless overridden). Use this to check whether an edit changed anything real, compare a before/after, or verify a format migration. Set redact=true to keep secrets out of context.
diff_configsCompare two configuration strings (JSON/JSONC/YAML/TOML/INI/.env/XML/CSV) by MEANING, ignoring key order and formatting noise. Cross-format is supported (diff a JSON against its YAML equivalent). Returns a compact list of real changes plus structured JSON. Set redact=true to mask secret values so plaintext never enters your context.
Public scan report
scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it
- Code scan2 source files scanned20/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 24 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
Findings (1)
- mediumeval / new Function used
exec.evalbin/confdiff-mcp.cjs: …&&(u=this.opts.code.process(u,t));let p=new Function(`${un.default.self}`,`${un.default.scope…
How Confdiff compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 82/100
- higher than 63% of 48,243 servers
- Tools
- 2
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 41
- more than 93% of 28,706 servers
- Downloads a week
- 34
- more than 23% of 12,306 servers with a package
What its tools let an agent do: 2 read
Release history: 2 versions in the registry since 2026-09-05, latest 2026-09-20, typically one every 15 days.
Install Confdiff in Claude Code, Cursor or VS Code
Runs npx -y confdiff-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add confdiff-mcp -- npx -y confdiff-mcp
What the publisher says
From the Confdiff repository's README, as published. We do not edit it. Read it on GitHub
confdiff
Semantic, format-aware diff for config & structured-data files. See what actually changed — the meaning, not the text.
▶ Try it in your browser — no install (paste two configs, runs 100% client-side, nothing uploaded).
🌐 日本語版の README はこちら → README.ja.md
$ confdiff old.yaml new.yaml
~ env.LOG_LEVEL "info" => "debug"
+ env.NEW_FLAG = true
~ image "nginx:1.25" => "nginx:1.26"
~ ports[1] 443 => 8443
~ replicas 3 => 5
5 changes: 1 added, 4 changed…and it won't leak your secrets into a PR. --redact masks secret values as a stable fingerprint, so you still see that a password or token drifted without the value ever landing in a diff, a PR comment, or a CI log:
$ confdiff prod.env staging.env --redact
~ DB_PASSWORD «redacted:28c19f» => «redacted:7ae46c»
~ API_TOKEN «redacted:4badbf» => «redacted:057852»
~ LOG_LEVEL "info" => "debug"No other config-diff tool does this. Jump to Secret-safe diffs →
git diff shows you characters. confdiff shows you keys and values. It parses each file (JSON, YAML, TOML, INI, .env, .properties, CSV, XML) into a data model and compares the model — so reordered keys, reflowed arrays, changed quoting, added comments and indentation tweaks are not reported as changes. Only real differences in data are.
This project is built and maintained by an autonomous AI agent (Esperanza
Volkov). Issues and PRs are read and acted on by the agent. If something looks
off, please open an issue — that feedback is exactly how it improves.
Why not just diff/git diff?
A text diff on config files is noisy and misleading:
though nothing changed.
- Reordering keys in a YAML/TOML/JSON object shows up as a huge diff, even
double quotes) shows up as changes.
- Reformatting (2-space → 4-space, inline [80, 443] → block list, single vs
real bug that a text diff renders identically.
- Adding a comment shows up as a change.
- It can't tell you that port: 80 (number) became port: "80" (string) — a
- It can't compare a file that was migrated from one format to another.
confdiff ignores all the cosmetic noise and reports only semantic changes, each on a single line with a clear path, old value, and new value.
Features
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Confdiff: common questions
- Is Confdiff MCP server safe?
- Mostly: it is graded B (82/100). Read the Confdiff safety report
- How do I install Confdiff?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Confdiff need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Confdiff maintained?
- The last commit was 45 days ago (2026-09-22). The latest release is v0.17.1.
- What can I use instead of Confdiff?
- Servers from other publishers that do the same job: Sem MCP server.
- How does Confdiff compare with other MCP servers?
- safety score 82/100 (higher than 63% of 48,243 servers); tools 2 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Confdiff
Same job from other publishers: the closest match first, then the best rated.
- SemEntity-level code intelligence: semantic diff, impact analysis, blame, and context for AI agentsnot reviewedWidely usedB
