The PR is
too late.

Verity reviews your coding agents while they work, before a PR exists. It finds 2× more real bugs than your typical PR review agent, and cuts bad PRs by 45%.

$npm install -g @codacy/verity-cli && verity init

Free plan. No credit card. macOS and Windows.See a live Verity report

29 of 46 agent runs working and secureSee our benchmark

Same agent. Same tasks. 45% fewer bad PRs.

Each tile below is one real agent run. Working code with a security flaw falls from 23 runs to 8, 65% fewer.

Without Verity

15

working and secure

Coding agent
Nothing checks it
Nothing checks it

With Verity

29

working and secure

up from 15

Coding agent
Verity
Verity

Findings go back. The agent fixes them.

Each tile is one real agent run: the same 23 tasks, run twice per setup. A bad PR fails the hidden feature tests or security tests. Our own benchmark, with Verity at maximum review effort. See the benchmark.
Works and is secureWorks, with a security flawDoes not work

Works with

OpenAI CodexSoonCI/CDSoonGitHub Agentic WorkflowsSoonAI GatewaySoon

Teams building with agents already get it.

TolariaBLACK BOX
  • “I pulled CodeRabbit out of my pre-push hook because it kept timing out. The Verity responses were a lot faster, and the knowledge graph approach is huge for multi-agent workflows.”
    Erik JostChief Digital & AI Strategist, Black Box
  • “Verity caught exactly the kind of issues that matters: things that violated our ADRs, unsafe code, and more.”
    Luca RossiFounder of Tolaria
  • “Verity does an excellent job keeping Claude honest, and flags issues before they hit GitHub and waste a CI run.”
    Craig BehnkeFounder of Commander Finance

Stop the flood of bad PRs.

Agents made writing code cheap. They did not make reviewing it cheap. A PR agent reads the same finished code, at the same late moment, while the queue keeps growing.

Read why the PR is too late

Verity finds 2× more real bugs than your typical PR agent

A PR agent reads the code once, when it is finished. Verity reviews each commit and push, while the coding agent can still fix what it finds.

Verity reviews at commit and at push, and its findings go back to the agent. A PR agent reviews once, at the pull request, when the code is finished.
Verity reviews each one
PR agent reviews once
Agent writes code
Commit
Push
Pull request

Each finding goes back to the agent, which can still fix the code

Code is finished

Real bugs found per task
Verity, every commit and push of the work
2.33
PR agent on gpt-6-astra, one review of the finished PR
1.21
PR agent, default settings, one review of the finished PR
1.13
See how we measured this

What the coding agent gets

A verdict, with the file and line of each finding, before the code leaves its hands.

  1. 1The agent says it is done

    Claude Code builds an admin panel and reports the work as finished.

  2. 2Verity reviews the turn

    When the agent stops, Verity checks the change against your Standard, before anything reaches a PR.

  3. 3The verdict goes back

    Each finding names the file, the line and the fix, written for the agent.

  4. 4The agent fixes it

    It starts on the high findings at once, then commits the fix.

  5. 5The commit and push gates

    The commit gets a full review. At push, Verity models the riskiest function formally before the code leaves.

Verity reviews the agent, not just the code

Verity is not a skill that your agent calls when it remembers to. It is a harness that follows your agent's harness: Claude Code runs it at the moments you choose, each turn, commit or push, outside the agent's context window. It reads the session on your machine: every file the agent read, every edit, and every command and script it ran, with its result.

A PR agent sees the diff. Verity sees how it was written.

An example. A PR agent sees only the final diff. Verity also sees the session: the spec the agent read, a failing test run, an expected value the agent changed, a passing run, and the agent saying the tests pass.

What a PR agent sees

src/payments.ts- if (amount <= 0) throw new RefundError()+ if (amount < 0) throw new RefundError()test/payments.test.ts- expect(refund(order)).toBe(100)+ expect(refund(order)).toBe(90)

What Verity sees

  1. Readspec/refunds.mdbecomes the rubric for intent
  2. Editsrc/payments.ts
  3. Runnpm test2 failed
  4. Edittest/payments.test.tschanged an expected value
  5. Runnpm testpassed
  6. Say“Done. All tests pass.”

Test tampering. The finding goes back to the agent before the commit.

  • It reviews what this agent wrote

    The session shows which edits are the agent's. A teammate's change, or work that was there before the session, is never blamed on it.

  • It grades against what was asked

    The goal you stated, and the specs and plans the agent actually read, become the rubric for intent.

  • It holds the agent to its word

    When the agent says a turn is only housekeeping, Verity checks that against what the turn did. If the agent wrote code, the review runs anyway. The rules against weakened tests and silenced checks are on for every project.

The session stays on your machine. What leaves is the files under review and facts about each command: the program, the subcommand and whether it passed, never an argument value. Verity has no access to your code on GitHub: its GitHub app reads only your email address and repository metadata.

The rules are public. Read them.

The catalog lists what Verity looks for. Each rule names the evidence a finding must show, with examples of bad, good and near-miss code. Some rules are on for every project, verity init selects the others from your stack, and you can turn off any rule.

See the catalog

Verity finds bugs by trying every sequence, then running the one that breaks your code

Some bugs get through review because every line looks right. Verity builds a formal model of your function, searches it for the exact sequence that breaks it, and runs that sequence on the real code. You get a failure, not an opinion.

No other code review tool does this.

Some tools can re-run a security finding in a sandbox. In November 2026 we found none that models a function formally, searches the model, and replays the failure at the push.

  1. 1. Model

    Verity writes a small formal model of one risky function, and the rule it must keep.

  2. 10 of 10 orders triedOne breaks the rule

    2. Search

    It searches the possible orders and outcomes of the function's steps, up to a limit, for one that breaks the rule.

  3. 3. Replay

    It runs that case on the function's real code, with stand-ins for what the function calls. Only a failure that reproduces can block a push.

The search above is an example: two requests, five steps, ten possible orders. Each path from left to right is one order.

It found a double-booking bug in Cal.com's open-source code

A failed calendar answer read as a free slot, so a booking could land on top of an existing meeting. The code had been there since 2022. We reported it with two failing tests (calcom/cal.diy#30382), and contributors opened two fix PRs within two days.

See the bug, step by step

Also in the box

Agents write the code. Verity keeps it true.

Start on the Free plan. Working with Claude Code today.

See the benchmarkQuestions? Chat with us on Slack
$npm install -g @codacy/verity-cli && verity init

Works with

OpenAI CodexSoonCI/CDSoonGitHub Agentic WorkflowsSoonAI GatewaySoon