vighriday/Veris

veris — Latin, “of truth”
Your agent just changed 40 files. What actually broke, and was any of it checked?
---
We pointed Veris at Veris — it found 55 defects
Every one is published — what broke, why it mattered, the fix, and the test that
proves it: **docs/internal/BUG_TRACKER.md**
The worst three, in our own tool:
**It invented baselines.**
When git was unavailable, Veris built a "before" state from the first 70% of the
current graph and reported the comparison as a real behavioral diff. No flag. No
warning. A verification tool was fabricating the thing it verified against.
**91% of its call edges were guesses.**
It matched the trailing name of a call against every declaration sharing that name.
console.log() drew an edge to the project's own Logger.log. Measured on a real
dependency: 2,804 of 3,077 edges pointed at an ambiguous name.
**The graded agent could erase its own failures.**
Execution results were stored with INSERT OR REPLACE. Post fail, then post
pass, and the failure was gone.
We could have fixed these quietly. Publishing them is the point: a tool that tells
you what is unverified has no standing to hide its own unverified claims.
**This is also the demo.** That is the analysis Veris performs, run on itself.
---
What Veris is
A **behavioral diff for AI-written code**, speaking the Model Context Protocol so
your agent can ask *while it is still working* — not after you find out in review.
It answers two questions a line diff cannot:
1. **What behavior changed?** Not which lines — which behaviors, and what reaches them.
2. **Was any of it actually checked?** Published research puts roughly **65% of
agent-authored PRs at zero coverage of their own changed lines**.
**Veris never executes anything.** No tests, no sandboxes, no runtime. It reads,
models, and tells your agent what is at risk and what evidence exists. Running things
stays with the tools that are good at running things.
Veris is not Because
A test runner It executes nothing. It tells your runner what is worth running.
A linter or SAST tool No rules about style or known-bad patterns. It models behavior change.
An "AI guardrail" That means filtering model output. This is about the code the model writes.
A coverage tool Coverage says which lines ran. Veris says which behaviors changed and what backs them.
---
The 30-second version
**Read lines 2 and 4 again — they are the whole philosophy.**
Six calls were too ambiguous to resolve, so Veris drew **no edge** rather than
guessing. The head is marked -dirty because uncommitted changes were included, so
the result is **not reproducible from commits alone**.
Most tools report only what they found. Veris also reports what it could not
determine, because a confident wrong answer is worse than an admitted gap.
---
Install
**As an MCP server** — one config block, then restart your client:
17 tools light up in Claude Code, Cursor, or any MCP-compatible agent.
**As a CLI:**
> **Needs a git repository with real history.** Veris diffs against the merge-base
> with your base ref. If it cannot establish one, it **fails and says why** rather
> than inventing a baseline. In CI: fetch-depth: 0.
> **On npm 12, run history needs one extra line.** npm 12 no longer runs dependency
> install scripts by default, so better-sqlite3 never fetches its prebuilt binding.
> Veris still analyzes, diffs, scores risk and plans verification — only run history
> and cross-run drift need it. The allowlist is per-project and is *not* inherited
> from a dependency, so it has to go in **your** package.json:
>
>
>
> Then npm rebuild better-sqlite3. veris-core doctor reports which mode you are in,
> and never claims persistence is working when it is not.