Review gates
Checked at every turn, commit and push.
Verity reviews what your coding agent writes while it works. Each finding goes back to the agent with the file, the line and the fix, so it is fixed before anyone opens a PR.
npm install -g @codacy/verity-cli && verity initThree moments, all on by default
| Moment | Reviews | Can block |
|---|---|---|
| Each turn | What the agent wrote this turn, minus what Verity already judged | Yes |
| Before commit | The staged diff, whole | Yes |
| Before push or PR | The commits about to be pushed, whole | Yes |
Pick your own: verity config moments turn,commit,push. Many teams turn the turn review off and gate only commit and push.
Two layers
Trivy runs on your machine for secrets, malicious packages and vulnerable dependencies. Then a model that did not write the code judges the change against your Standard.
A verdict the agent answers
PASS, WARN or FAIL, with file-and-line findings, typically in under 30 seconds on a turn. On a FAIL the agent fixes the findings and the gate runs again.
Heavier at commit and push
The whole change ships for review, up to 120 files, to a stronger model with a three-minute budget. At push, Verity can model one risky function formally and replay any failure on the real code.
What blocks, and what does not
A critical or high-severity quality or security finding, in a file that is part of the change, holds the commit or push until the agent fixes it.
A WARN never blocks, and neither does a change that reads differently from its commit message when nothing in it is unsafe. Verity also never blocks on a file it did not review: a leftover finding from an earlier run is marked pre-existing.
See our benchmark
Works with Claude Code today. On Windows, Trivy does not run, so static analysis is off and the model review carries on unchanged.
Agents write the code.
Verity keeps it true.
Start on the Free plan. Working with Claude Code today.
npm install -g @codacy/verity-cli && verity initWorks with