An MCP server your agent calls to check its own changes.
Veridu is a remote MCP server. Your coding agent sends a change before it commits and gets back independent findings with the evidence for each, fixes what holds up and checks again. The same server reviews a GitHub pull request when you give it the link.
https://api.veridu.io/mcp
Streamable HTTP. Sign-in is OAuth in your browser, so there is no key to paste into a config file.
Checks a change before it is committed.
Takes: The diff, the full content of the changed files, and optionally a sentence on what the change is for, the repository name and the id of an earlier check (to make this a follow-up).
Returns: An outcome (pass, review or block), findings with location, severity and evidence, coverage notes, and on a follow-up which findings persist, which are new and which are no longer reported. Results are advisory.
Fetches the result of a check that was still running.
Takes: The change id verify_change returned.
Returns: The same result as verify_change, once it is ready.
Reviews a GitHub pull request.
Takes: The pull request URL.
Returns: The outcome and findings, or a review id to follow while it runs. Asking again for the same pull request head returns the existing review. Nothing is posted to GitHub from this tool.
Follows a pull request review.
Takes: The review id.
Returns: The review's progress, then its result.
Windsurf and other MCP clients take the endpoint above; the docs cover each one.
Add this line to CLAUDE.md, AGENTS.md or your client's rules:
Before committing, call Veridu's verify_change. Review and fix valid findings, then run it again to check what is still open.
How does a client sign in?
With OAuth in the browser: add the server, approve in the browser, and the client holds a token. Veridu stores only a hash of it. Clients that cannot complete browser sign-in use an MCP-only token from veridu.io, and JetBrains AI Assistant uses a personal connection URL from veridu.io/connect.
Do I need an OpenAI or Anthropic API key?
No. The reviewers run on Veridu's own OpenAI and Anthropic API access. A check counts against your Veridu reviews, not your AI plan.
Does it read my whole repository?
verify_change does not: it reviews only the diff and files the agent sends, in an isolated sandbox with no internet access. For PHP it also traces callers and overrides within those files. veridu_review reads the pull request from GitHub and traces the code it affects; a private repository has to be linked on veridu.io first.
What does it cost?
Each new change or pull request uses one review. The free tier includes up to 20 reviews a month, with no card, and the first two follow-ups on a change are free. Reviewing a private repository, or a change linked to one, needs a paid plan.
What are the limits?
Text files only. The diff can touch up to 60 files and be up to 256 KB. The files sent with it can be up to 120, at most 256 KB each and 512 KB in total.
Which languages does it understand?
Any language can be reviewed. Tracing callers, overrides and references to removed code goes deepest for PHP. For TypeScript, JavaScript and Python it finds the changed definitions and searches for related code (within the files sent for a check, in the repository for a pull request), which is lighter than a call graph.
A worked example of one change checked, fixed and checked again, and how Veridu handles your code: security.