How to verify Claude Code's changes before you commit.
Claude Code writes the change. Veridu checks it independently, Claude Code fixes what holds up and checks again, and you decide whether to commit with an outside review of the change in hand.
claude mcp add --transport http veridu https://api.veridu.io/mcp
Then run /mcp, choose veridu, then Authenticate, and approve in the browser. There is no token to copy and no repository to connect.
Add this line to your CLAUDE.md:
Before committing, call Veridu's verify_change. Review and fix valid findings, then run it again to check what is still open.
Or ask for a check when you want one: "verify this change with Veridu". Optional: the plugin adds the same server plus a verify-before-commit skill that runs the loop:
claude plugin install veridu --marketplace michaelw-pr/veridu-plugin
It calls verify_change with the diff, the full content of the files it changed and a sentence on what the change is for. Independent reviewers check it in an isolated sandbox. A check usually takes one to two minutes.
What comes back:
- An outcome: pass, review or block.
- Findings with the file, line, severity and the evidence behind each one.
- A finding id that Veridu tries to keep the same across follow-ups, matching on the file, the code and the nearby lines.
- On a follow-up: which findings persist, which are new (possibly introduced by the fix), and which are no longer reported.
Claude Code passes the first check's id as parent_change, so the follow-up shows what persists, what is new and what is no longer reported. A finding that is no longer reported is not proof it was fixed. The first two linked follow-ups are free.
It sees only the files Claude Code sends, not your whole repository. For the code a change affects elsewhere, review the pull request too: how to review AI-generated pull requests.
Does Veridu read my whole repository?
No. Claude Code sends the diff and the full content of the files it changed, and Veridu reviews only those, in an isolated sandbox with no internet access. For PHP it also traces callers and overrides within the files it was sent. Results are advisory for that reason.
Do I need an Anthropic or OpenAI API key?
No. Only a Veridu sign-in, done once in the browser when you add the server.
Does Claude Code fix the findings by itself?
With the CLAUDE.md line above, it decides which findings are real, fixes them and checks again. You can also just ask it to "verify this change with Veridu" when you want a check.
Does a finding that disappears mean it was fixed?
No. A follow-up says whether the flagged line changed, but a reviewer can also simply not mention it again, so "no longer reported" is not proof of a fix. Read the diff before you commit.
What does it cost?
Each new change uses one review. The first two follow-ups linked to it are free, and resending the exact same request within seven days returns the earlier result at no cost. The free tier includes up to 20 reviews a month with no card. A change linked to a private repository needs a paid plan.
What are the limits?
Text files only (no binaries, renames, mode changes or symlinks). The diff can touch up to 60 files and be up to 256 KB. The files sent with it can be up to 120, at most 256 KB each and 512 KB in total.
The same loop works in Codex: verify Codex changes. Other MCP clients are covered in the docs.