Every review counted. Every limit published.

A session is a fixed 6-hour window. Sessions start at 00:00, 06:00, 12:00 and 18:00 UTC. Each member has a limit for each session. The week starts Monday 00:00 UTC. On Pro and Fleet, an account pools the weekly limits of its members.

Only completed reviews count: a review that returns a verdict. A review that is skipped or fails does not count. A commit and push review is one review at a commit or a push, with its agent review. A turn review is every other review, for example the review at the end of an agent turn.

No. You pay per member, not per agent. Every agent runs under the login of a member, and its reviews count against the limits of that member.

Extra usage is off by default. On Pro and Fleet, an admin can turn it on and set a monthly cap of at least $5. We suggest $50. Past a limit, each review then costs 20¢ for a commit and push review or 2¢ for a turn review, until the account reaches the cap. At a limit without extra usage, or at the cap, Verity skips the review and your work continues.

No. You buy Pro or Fleet, and the account starts with you. It grows in place: add people with an invite link, attach your orgs, or move a member to Fleet. None of these needs a second checkout.

A new member is charged pro rata until the renewal. Their weekly limit joins the account's pool at once.

We measured it. In our own benchmark, Verity found 2× the real bugs of PR-Agent, a popular open-source PR agent, and agents delivered working, secure code nearly twice as often. It ran at maximum review effort, which we set per project. See the benchmark and how we ran it.

Yes. Verity does not replace your reviewers. It fixes what it can before the PR exists, so the PRs that reach them are better.

It runs out-of-band through Claude Code hooks, at each commit and push and when the agent stops, in its own context window, so it never spends your agent's tokens. Layer 1 (the @codacy/analysis-cli) produces deterministic facts; Layer 2, an independent model that didn't write the code, judges them against your Standard. You get a PASS or BLOCK verdict with file-and-line findings.

Because a model can't review its own work — and that's mechanical, not philosophical. Models self-prefer (GPT-4 scored its own output 0.912, where 0.5 is neutral), fold under pushback, and iterative self-fixing backfires (+37.6% critical vulnerabilities after five rounds). Verity's reviewer never wrote the code, so the verdict isn't graded by its author.

Three lenses on every change: security (SAST, OWASP Top 10, leaked secrets, dependency risk), quality (bugs, regressions, maintainability, type safety), and intent — did the code do what was actually asked? Verity captures the original prompt and specs and checks the delivered code against them, catching drift at the source.

Never. The diff is analyzed in memory and deleted — only metadata persists: findings, scores, and decisions. Tokens are SHA-256 hashed, data is encrypted in transit and at rest, and every project is row-level isolated. Verity has no access to your code on GitHub: its GitHub app reads only your email address and repository metadata. Each run is a timestamped, versioned record — SOC 2 evidence that maps to ISO/IEC 42001, NIST AI RMF, and EU AI Act Article 12.

Those are inputs, and Verity uses them. On top of their signals it adds an independent model as the judge, an intent check they can't see, one shared Standard, and a project knowledge base — the difference between raw signals and an enforced, gated verdict.

CLAUDE.md is ephemeral and per-laptop. It does not treat quality, security, intent as a first class citizen, nor does it track the outcomes and analysis. Verity's Standard is compiled from your real codebase — shared and persistent across every agent, session, and machine.

No. The agent reads the findings and self-heals, capped at two iterations — fix-recheck cycles hit diminishing returns after round two, and unguided self-fixing keeps introducing new critical vulnerabilities past that point. Beyond the cap, the issue defers to a human; it only interrupts you when something is actually wrong.

Full support for Claude Code today (skills plus hooks), with API support for CI/CD. OpenAI Codex and GitHub agentic workflows are coming. Whatever writes the code, it answers to one shared Standard and one run history.

A native gate is locked to one environment. Verity is portable across every agent and harness — one Standard that survives whichever agent wins, with cost and memory that span your whole fleet.