Veridu

npx add-mcp 'https://api.veridu.io/mcp'

Get started

Five ways to use Veridu. Same reconciled reviewer panel underneath. Pick the one that fits your workflow.

Already use Claude Code or Codex?

One command, then sign in once

Add Veridu to your agent; it opens your browser to sign in the first time. No token to copy, no repository to link. Then, after your agent changes code, ask it to "verify this change with Veridu". Independent reviewers check it against the files your agent sends (for PHP, Veridu also traces callers and overrides within them), and your agent gets back grounded findings to fix — before you commit.

Claude Code (then run /mcp → veridu → Authenticate)

claude mcp add --transport http veridu https://api.veridu.io/mcp

Codex

codex mcp add veridu --url https://api.veridu.io/mcp && codex mcp login veridu

Or install Veridu from the ChatGPT plugin directory or the Claude connector directory. For VS Code, see its GitHub MCP Registry listing.

Let Claude Code set it up

Paste this into Claude Code (or Codex) and it handles setup and your first review. The rest of this page is the manual version.

Install Veridu from https://veridu.io/install.md, then verify my current changes with it.

Surface 1

Before the pull request · MCP in your agent

Add Veridu as a hosted MCP server. Browser sign-in is tested with Claude Code, Codex CLI, ChatGPT, Claude (claude.ai) and VS Code; other MCP clients work with browser sign-in or an MCP-only token. JetBrains AI Assistant connects with a personal connection URL from Connect your editor. Your agent gets verify_change (check its own change before you commit) and veridu_review (review a pull request).

Claude Code · one command

Add the server, then /mcp → veridu → Authenticate. Your browser opens veridu.io to sign in and approve; Claude Code keeps the connection from then on.

claude mcp add --transport http veridu https://api.veridu.io/mcp

Optional: the plugin adds the same server plus a verify-before-commit skill that runs the check, fixes what holds up and checks again: claude plugin install veridu --marketplace michaelw-pr/veridu-plugin

Codex · one command

codex mcp login opens the same browser sign-in.

codex mcp add veridu --url https://api.veridu.io/mcp && codex mcp login veridu

ChatGPT · plugin directory

Install Veridu from its ChatGPT plugin listing and sign in to veridu.io when asked.

Claude · connector directory

In Claude, add Veridu from its connector listing and sign in to veridu.io when asked.

VS Code · GitHub MCP Registry

Veridu is listed in the GitHub MCP Registry. For a one-click install and setup steps, see Veridu in VS Code.

Your agent then has two ways in: verify_change checks the change it just made, before any commit or pull request, and veridu_review reviews an existing GitHub pull request.

Cursor / Windsurf: add https://api.veridu.io/mcp as an MCP server. Other MCP clients take just the URL too. Browser sign-in works when the client signs in through a local (localhost) redirect; if it fails, create an MCP-only token at /tokens and send it as a Bearer header, or let Connect your editor make the token and the config for you. Step by step for Cursor: verify Cursor changes; for Junie or GitHub Copilot in PhpStorm: verify PhpStorm changes; for VS Code: verify VS Code changes.

{
  "mcpServers": {
    "veridu": {
      "url": "https://api.veridu.io/mcp"
    }
  }
}

An agent that can't open a browser (headless, CI) uses a token with the MCP only scope from Tokens. Full-access tokens are not accepted by the MCP server.

{
  "mcpServers": {
    "veridu": {
      "url": "https://api.veridu.io/mcp",
      "headers": { "Authorization": "Bearer <MCP-ONLY TOKEN>" }
    }
  }
}

verify_change · before you commit

• Your agent sends the diff and the full content of the files it changed. Nothing else from your repository is read, and the code is reviewed in an isolated sandbox that has no internet access.
• You get an outcome (pass, review or block) and findings with location, severity and evidence. Results are advisory: Veridu sees only what was sent, not the whole repository.
• Fix, then verify again: two follow-ups per change are free, and sending the identical change again returns the earlier result at no cost.
• Each new change uses one review: free accounts use their free reviews (up to 20 a month), subscribers use their plan. A change linked to a private repository needs a paid plan. Text files only, up to 60 files / 256 KB of diff.

Nice pattern

After your agent finishes a change, ask "Verify this change with Veridu and fix anything real." For an open pull request: "Have Veridu review my most recent PR."

Surface 2

Command line

The everyday-dev path. Install once, sign in once, run a review on any GitHub PR.

npm install -g veridu

veridu init

Prompts for your email → emails a 6-digit code → stores a token at ~/.veridu/config.json. Same account you'd use on the web.

veridu review https://github.com/owner/repo/pull/123

Runs a hosted review. ~60-90s. Prints the reconciled result - agreements, disputes, per-reviewer findings. Free tier: up to 20 reviews a month on public repos. Re-running against a force-pushed PR counts as another review.

Advanced

• --models codex,claude-opus-5 - pick a reviewer panel (paid tier)
• --json - raw result JSON for tooling
• --local - BYOA fallback using your own OpenAI + Anthropic keys

Surface 3

Web · paste a URL

For one-off reviews or when you're between machines. Sign in, head to Reviews → Run a review, paste a PR URL.

Renders in the browser with live status while the review runs. Same result view as the CLI, plus inline adjudication: mark any individual finding 👍 / 👎 / unsure, and click the same mark again to clear it.

Surface 4

On the pull request · GitHub App

For teams. Install the Veridu GitHub App on GitHub, then link each repository on the Repos page. Repositories added to the installation later need linking too — until a repository is linked, its pull requests show a neutral Veridu setup check with a link to finish.

Each review checks the pull request against the code it affects outside the diff. Overview: automatic review on every pull request.

When a pull request is reviewed

• Ready for review — reviewed once, automatically, when it is opened ready or marked ready. Findings post as a PR comment and a Veridu check.
• Drafts — not reviewed. A half-finished branch changes constantly; mark it ready and Veridu picks it up.
• New commits — not reviewed automatically. The check changes to a neutral New commits not reviewed, and an approval Veridu gave the earlier commit is withdrawn.
• /veridu review — comment it on the pull request to review the current commit. Owners, members and collaborators can use it, up to 20 times a day per account. The comment is updated in place.
• Bot pull requests (Dependabot, Renovate, …) — skipped.

Surface 5

API · in your CI / pipeline

For scripted flows — a GitHub Actions job, a GitLab CI stage, an internal review bot. Two endpoints do the whole flow.

curl -X POST https://api.veridu.io/reviews \
  -H "Authorization: Bearer $VERIDU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"pr_url":"https://github.com/OWNER/REPO/pull/N"}'
# → 201  {"review_id":"<uuid>","status":"queued","models":["codex","claude-sonnet-5"]}

2 · Get results (webhook, don't poll)

Register a webhook target once at /webhooks. We POST a signed body when the review completes — replaces polling GET /reviews/<uuid> every N seconds.

POST https://your-app/webhooks/veridu    (from us to you)
X-Veridu-Signature: t=<unix>,v1=<hmac-sha256(t + '.' + body)>
Content-Type: application/json

{
  "event_type": "review.completed",
  "delivered_at": "2026-08-25T20:41:00Z",
  "review_id": "<uuid>",
  "verdict": "clean" | "low" | "medium" | "high" | "critical" | "unknown" | "incomplete",
  "outcome": "pass" | "review" | "block",
  "blocking_level": "high" | null,
  "agreements": [...],
  "disputes": [...]
}

unknown — a reviewer did not return, so nothing can be said. incomplete — no problems in what was reviewed, but some changed code was not: files marked generated, vendored or minified, or a diff too large to review in full. Both read as review, never pass, and veridu verify --exit-on-verdict exits 3 for them.

curl https://api.veridu.io/reviews/<uuid> \
  -H "Authorization: Bearer $VERIDU_TOKEN"

Advanced

• Scoped tokens — from /tokens pick reviews_only for CI — can hit /reviews but not billing/team/etc. Limits blast radius on a leaked CI secret.
• OpenAPI spec — the machine-readable version of this page lives at api.veridu.io/openapi.json.
• Rate limits — no hard rate limits today (early access). Fair-use kicks in at ~50 review-starts/min sustained; we email first.