Your Standard

One Standard for every agent.

Your team's rules live in one versioned file, committed to the repository. Every review, on every machine and in every session, is measured against it by a reviewer the agent cannot argue with.

.verity/standard.yaml
extends:
  - verity/core          # every project
  - verity/api           # chosen from your stack by verity init
overrides:
  type_safety: off       # turn off any rule or lens
custom_patterns:
  - id: validate-at-boundaries
    severity: high
    rationale: >
      Applies to user input, external APIs and webhook payloads only.
      Internal service-to-service calls are out of scope.

Start from the public rules

A Standard extends review packs from the rule catalog. verity/core applies to every project, and verity init picks the others from your stack: API, Data, CLI, Payments, Web. Each rule names the evidence a finding must show.

Turn any rule off, or change its severity, in overrides. The packs bring their rules, so the file holds only what your team changed.

See the rule catalog

  • Comprehensibility

    Code you can read in one context load. Defaults: files up to 300 lines, functions up to 50, complexity up to 15.

  • Modularity

    One concern changes without touching three or more files.

  • Type safety

    The type system catches errors before runtime. Add your language's own, such as strict mode.

  • Test adequacy

    Tests define what the code should do: 80% coverage by default, 90% for AI-written code.

Security rules mapped to CWEs

Security rules in verity/core, their severity and the CWEs they map to
Rule in verity/coreSeverityMaps to
Injection into an interpreterCriticalCWE-89, 78, 94, 502, 611
No hardcoded secretsCriticalCWE-798
Object-level authorizationHighCWE-639, 862
Checks fail closedHighCWE-636, 755
Secrets and personal data in logsHighCWE-532, 359

Plus seven more in core, and the API, CLI and Web packs add rules for their kind of project.

Your project's own rules

The conventions a reviewer would otherwise learn by hand, such as “all API routes go through the auth middleware”. Verity can write them from your repository profile, and you add your own.

A rule's rationale reaches the reviewer word for word, so a rule that says where it applies is applied only there.

Read the docs

Agents write the code. Verity keeps it true.

Start on the Free plan. Working with Claude Code today.

See the benchmarkQuestions? Chat with us on Slack
$npm install -g @codacy/verity-cli && verity init

Works with

OpenAI CodexSoonCI/CDSoonGitHub Agentic WorkflowsSoonAI GatewaySoon