Veridu
Documentation

Get started

Five ways to use Veridu. Same reconciled reviewer panel underneath. Pick the one that fits your workflow.

Already use Claude Code or Codex?

One command, then sign in once

Add Veridu to your agent; it opens your browser to sign in the first time. No token to copy, no repository to link. Then, after your agent changes code, ask it to "verify this change with Veridu". Independent reviewers check it against the files your agent sends (for PHP, Veridu also traces callers and overrides within them), and your agent gets back grounded findings to fix — before you commit.

Claude Code (then run /mcp → veridu → Authenticate)
claude mcp add --transport http veridu https://api.veridu.io/mcp
Codex
codex mcp add veridu --url https://api.veridu.io/mcp && codex mcp login veridu
Fastest start

Let Claude Code set it up

Paste this into Claude Code (or Codex) and it handles setup and your first review. The rest of this page is the manual version. 

Install Veridu from https://veridu.io/install.md, then verify my current changes with it.
Surface 1

MCP · inside your agent

Add Veridu as a hosted MCP server. Browser sign-in is tested with Claude Code and Codex CLI; other MCP clients work with browser sign-in or an MCP-only token. Your agent gets verify_change (check its own change before you commit) and veridu_review (review a pull request).

Claude Code · one command

Install the plugin: it adds the server and a verify-before-commit skill that runs the check, fixes what holds up and checks again. Then /mcp → veridu → Authenticate. Your browser opens veridu.io to sign in and approve; Claude Code keeps the connection from then on. 

claude plugin install veridu --marketplace michaelw-pr/veridu-plugin

Or just the server: claude mcp add --transport http veridu https://api.veridu.io/mcp

Codex · one command

codex mcp login opens the same browser sign-in. 

codex mcp add veridu --url https://api.veridu.io/mcp && codex mcp login veridu

Your agent then has two ways in: verify_change checks the change it just made, before any commit or pull request, and veridu_review reviews an existing GitHub pull request.

Other agents · config snippet

Cursor, Windsurf and other MCP clients take just the URL. Browser sign-in works when the client signs in through a local (localhost) redirect; if it fails, create an MCP-only token at /tokens and send it as a Bearer header. 

{
  "mcpServers": {
    "veridu": {
      "url": "https://api.veridu.io/mcp"
    }
  }
}

An agent that can't open a browser (headless, CI) uses a token with the MCP only scope from Tokens. Full-access tokens are not accepted by the MCP server. 

{
  "mcpServers": {
    "veridu": {
      "url": "https://api.veridu.io/mcp",
      "headers": { "Authorization": "Bearer <MCP-ONLY TOKEN>" }
    }
  }
}
verify_change · before you commit
  • Your agent sends the diff and the full content of the files it changed. Nothing else from your repository is read, and the code is reviewed in an isolated sandbox that has no internet access.
  • You get an outcome (pass, review or block) and findings with file, line, severity and evidence. Results are advisory: Veridu sees only what was sent, not the whole repository.
  • Fix, then verify again: two follow-ups per change are free, and sending the identical change again returns the earlier result at no cost.
  • Each new change uses one review: free accounts use their 20 free reviews a month, subscribers use their plan. Text files only, up to 60 files / 256 KB of diff.
Nice pattern

After your agent finishes a change, ask "Verify this change with Veridu and fix anything real." For an open pull request: "Have Veridu review my most recent PR."

Surface 2

Command line

The everyday-dev path. Install once, sign in once, run a review on any GitHub PR.

1 · Install
npm install -g veridu
2 · Sign in
veridu init

Prompts for your email → emails a 6-digit code → stores a token at ~/.veridu/config.json. Same account you'd use on the web.

3 · Review a PR
veridu review https://github.com/owner/repo/pull/123

Runs a hosted review. ~60-90s. Prints the reconciled result - agreements, disputes, per-reviewer findings. Free tier: 20 reviews a month. Re-running against a force-pushed PR counts as another review.

Advanced
  • --models codex,claude-opus-5 - pick a reviewer panel (paid tier)
  • --json - raw result JSON for tooling
  • --local - BYOA fallback using your own OpenAI + Anthropic keys
Surface 3

Web · paste a URL

For one-off reviews or when you're between machines. Sign in, head to Reviews → Run a review, paste a PR URL.

Renders in the browser with live status while the review runs. Same result view as the CLI, plus inline adjudication: mark any individual finding 👍 / 👎 / unsure, and click the same mark again to clear it.

Surface 4

GitHub App · reviews on your pull requests

For teams. Install the Veridu GitHub App on GitHub, then link each repository on the Repos page. Repositories added to the installation later need linking too — until a repository is linked, its pull requests show a neutral Veridu setup check with a link to finish.

When a pull request is reviewed
  • Ready for review — reviewed once, automatically, when it is opened ready or marked ready. Findings post as a PR comment and a Veridu check.
  • Drafts — not reviewed. A half-finished branch changes constantly; mark it ready and Veridu picks it up.
  • New commits — not reviewed automatically. The check changes to a neutral New commits not reviewed, and an approval Veridu gave the earlier commit is withdrawn.
  • /veridu review — comment it on the pull request to review the current commit. Owners, members and collaborators can use it, up to 20 times a day per account. The comment is updated in place.
  • Bot pull requests (Dependabot, Renovate, …) — skipped.
Surface 5

API · in your CI / pipeline

For scripted flows — a GitHub Actions job, a GitLab CI stage, an internal review bot. Two endpoints do the whole flow.

1 · Enqueue a review
curl -X POST https://api.veridu.io/reviews \
  -H "Authorization: Bearer $VERIDU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"pr_url":"https://github.com/OWNER/REPO/pull/N"}'
# → 201  {"review_id":"<uuid>","status":"queued","models":["codex","claude-sonnet-5"]}
2 · Get results (webhook, don't poll)

Register a webhook target once at /webhooks. We POST a signed body when the review completes — replaces polling GET /reviews/<uuid> every N seconds. 

POST https://your-app/webhooks/veridu    (from us to you)
X-Veridu-Signature: t=<unix>,v1=<hmac-sha256(t + '.' + body)>
Content-Type: application/json

{
  "event_type": "review.completed",
  "delivered_at": "2026-08-25T20:41:00Z",
  "review_id": "<uuid>",
  "verdict": "clean" | "low" | "medium" | "high" | "critical" | "unknown" | "incomplete",
  "outcome": "pass" | "review" | "block",
  "blocking_level": "high" | null,
  "agreements": [...],
  "disputes": [...]
}

unknown — a reviewer did not return, so nothing can be said. incomplete — no problems in what was reviewed, but some changed code was not: files marked generated, vendored or minified, or a diff too large to review in full. Both read as review, never pass, and veridu verify --exit-on-verdict exits 3 for them.

Or, if you must poll
curl https://api.veridu.io/reviews/<uuid> \
  -H "Authorization: Bearer $VERIDU_TOKEN"
Advanced
  • Scoped tokens — from /tokens pick reviews_only for CI — can hit /reviews but not billing/team/etc. Limits blast radius on a leaked CI secret.
  • OpenAPI spec — the machine-readable version of this page lives at api.veridu.io/openapi.json.
  • Rate limits — no hard rate limits today (early access). Fair-use kicks in at ~50 review-starts/min sustained; we email first.
Legal + privacy
Data handlingTermsStatus