Review gates

# Checked at every turn, commit and push.

Verity reviews what your coding agent writes while it works. Each finding goes back to the agent with the file, the line and the fix, so it is fixed before anyone opens a PR.

$`npm install -g @codacy/verity-cli && verity init`

Coding agent

Each turn what it just wrote

Each commit the whole staged diff

Each push the commits, plus formal check

Your PR

Findings go back from each gate. The agent fixes them, and fewer bad changes get through each one.

## Three moments, all on by default

*When Verity reviews, what it reviews, and whether it can block*

| Moment | Reviews | Can block |
| --- | --- | --- |
| Each turn | What the agent wrote this turn, minus what Verity already judged | Yes |
| Before commit | The staged diff, whole | Yes |
| Before push or PR | The commits about to be pushed, whole | Yes |

Pick your own: `verity config moments turn,commit,push`. Many teams turn the turn review off and gate only commit and push.

- **Two layers** Trivy runs on your machine for secrets, malicious packages and vulnerable dependencies. Then a model that did not write the code judges the change against your Standard.
- **A verdict the agent answers** PASS, WARN or FAIL, with file-and-line findings, typically in under 30 seconds on a turn. On a FAIL the agent fixes the findings and the gate runs again.
- **Heavier at commit and push** The whole change ships for review, up to 120 files, to a stronger model with a three-minute budget. At push, Verity can model one risky function formally and replay any failure on the real code.

## What blocks, and what does not

A critical or high-severity quality or security finding, in a file that is part of the change, holds the commit or push until the agent fixes it.

A WARN never blocks, and neither does a change that reads differently from its commit message when nothing in it is unsafe. Verity also never blocks on a file it did not review: a leftover finding from an earlier run is marked pre-existing.

29 of 46 agent runs came out working and secure with Verity, up from 15.
[See our benchmark](https://verity.md/benchmark)

Works with Claude Code today. On Windows, Trivy does not run, so static analysis is off and the model review carries on unchanged.

[Read the docs](https://verity.md/docs/moments)

## Agents write the code. Verity keeps it true.

Start on the Free plan. Working with Claude Code today.

[See the benchmark](https://verity.md/benchmark) [Questions? Chat with us on Slack](https://start-chat.com/slack/codacy/C1rsa5)

$`npm install -g @codacy/verity-cli && verity init`

Works with

OpenAI Codex Soon CI/CD Soon GitHub Agentic Workflows Soon AI Gateway Soon

Source: https://verity.md/product/gates